Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <RrVCUf0UYM4S99v51o8A6lAatx04FP2OR23b5CU8yUASHP5KYo_uzDUGevjvZdhYY8QxFFH190BQOw-r2TG7neN7NOkiAyixvsVOzwCpcs8=@protonmail.com>
Date: Tue, 21 Apr 2020 17:41:42 +0000
From: "jellicent@...tonmail.com" <jellicent@...tonmail.com>
To: "info@...nvakil.com" <info@...nvakil.com>
Cc: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Pacman package manager - taking untrusted input

On Tuesday, April 21, 2020 5:21 PM, Amin Vakil <info@...nvakil.com> wrote:
> Although this is something that can be fixed, it's not a critical
> security issue at all, in all scenarios that has been written if
> database is compromised, the best (worst) thing that malicious actor can
> do is stopping user from installing packages, because he can't create a
> verified gpg signed package which is mandatory for pacman to allow
> installation of the package.

This is incorrect. An attacker need only find a bug in how Pacman does
parsing/reading of the database file to potentially get code execution
on the box as root. See Pacman's CVE history for at least one example
of this. The problem happens before any package signatures come into
play.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.