[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <nc6fs4$ta1$1@ger.gmane.org>
Date: Mon, 14 Mar 2016 16:55:14 +0300
From: "Yuriy M. Kaminskiy" <yumkam@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-Request - GNU Awk.
On 14.03.2016 15:26, Tomas Hoger wrote:
> On Mon, 14 Mar 2016 06:32:28 +0000 Steve Kemp wrote:
>
>> I reported two DoS bugs against GNU Awk to the debian
>> bug tracker recently, both of which are denial of service
>> attacks causing NULL-pointer deferences.
>>
>> It would be useful to have a CVE identifiers assigned.
>
> Why should these get a CVE? As you state in one of your reports:
>
> While I appreciate that passing untrusted code to gawk is not a
> common thing to do, I do not believe that it should be possible to
> trigger a segfault though.
>
> Why should that be considered a valid / safe use case at all? If
> something makes awk run untrusted programs, there's code execution
> problem already:
>
> echo | awk '{ system("id") }'
What if someone generates awk script using data from untrusted source,
and avoids all theoretically-dangerous constructs (like system()), but
their filter miss something theoretically-innocent that can trigger
SIGSEGV (or worse) due to bug in gawk.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
