[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0811171635140.16579@faron.mitre.org>
Date: Mon, 17 Nov 2008 16:43:36 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security <oss-security@...ts.openwall.com>
cc: coley@...re.org
Subject: Re: CVE Request (syslog-ng)
On Mon, 17 Nov 2008, Josh Bressers wrote:
> syslog-ng doesn't call chdir() before calling chroot().
This falls under the notion of "protection mechanism works less securely
than advertised" so is a clear case for inclusion in CVE. Use
CVE-2008-5110.
Also - is the chdir supposed to come BEFORE or AFTER? The CERT secure
coding rules here:
https://www.securecoding.cert.org/confluence/display/cplusplus/FIO16-CPP.+Limit+access+to+files+by+creating+a+jail
suggest it might be safer AFTER, not before, due to some race condition
possibilities.
- Steve
======================================================
Name: CVE-2008-5110
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5110
Reference: CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505791
Reference: MLIST:[oss-security] 20081117 CVE Request (syslog-ng)
Reference: URL:http://www.openwall.com/lists/oss-security/2008/11/17/3
syslog-ng does not call chdir before it calls chroot, which might
allow attackers to escape the intended jail. NOTE: this is only a
vulnerability when a separate vulnerability is present.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
