[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0808261015310.18466@faron.mitre.org>
Date: Tue, 26 Aug 2008 10:19:17 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: CVE Request (gpicview)
Jan,
Are there common usage scenarios under which gpicview would receive the
filename to create from some external source, say, as a web browser
plugin?
I'm asking because the missing "ask_before_save" issues only seem like
non-security bugs - the user messing him/herself up - unless the target
file can be influenced by an external attacker.
> http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869
>
> Possible symlink attack via the temporary created "/tmp/rot.jpg"
> file used for image rotation.
Use CVE-2008-3791
> 2,
>
> http://sourceforge.net/tracker/index.php?func=detail&aid=2019485&group_id=180858&atid=894869
>
> By presence of the LIBJPEG library we could without confirmation rewrite
> the by the symlink targeted JPEG filesystem file.
>
> 3,
>
> http://sourceforge.net/tracker/index.php?func=detail&aid=2019492&group_id=180858&atid=894869
>
> Consequences: Bad enough, just think about them in context of the two
> previously mentioned issues.
These two might need a second CVE depending on the influence over the file
that "ask_before_save" would ask about.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
