oss-security - Re: Security risk of server side text editing in general and vim.tiny specifically

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171113145336.GA23241@openwall.com>
Date: Mon, 13 Nov 2017 15:53:36 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Security risk of server side text editing in general and vim.tiny specifically

On Fri, Nov 03, 2017 at 11:07:14AM +0000, Fiedler Roman wrote:
> PS: POC for vim.tiny on Ubuntu Xenial to overwrite arbitrary files as user root when editing file in directory owned by other user is available on request, disclosure after one week or if list discussion indicates other timing.

Please post this PoC in here ASAP.  Right now, you're in violation of
distros list policy for having posted the PoC in there yet not made it
public on oss-security within 7 days after posting about the issue
itself in here.  Please correct this.  (To me this is also an example of
misuse of the distros list, and then of the ability to delay posting the
PoC - creating administrative work for all of us out of thin air.)

The policy:

http://oss-security.openwall.org/wiki/mailing-lists/distros#list-policy-and-instructions-for-reporters

"If you shared exploit(s) that are not an essential part of the issue
description, then at your option you may slightly delay posting them to
oss-security but you must post the exploits to oss-security within at
most 7 days"

Also, it looks like Gentoo and Amazon failed to track this and remind
you on November 10.  They should have, as per:

http://oss-security.openwall.org/wiki/mailing-lists/distros#contributing-back

"12. If exploit(s) were shared on the list, make sure that either
they're included in the oss-security posting along with the issue detail
or the posting includes an announcement of planned later posting of the
exploits (with the delay being within list policy), and in the latter
case also make sure that the later posting is in fact made as planned,
and remind the reporter if not - primary: Gentoo, backup: Amazon"

So at least this worked as an almost failed test of our handling of this
little administrative task.  Maybe on some other occasion it would be
actually important, so let's debug and fix it now.

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.