[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <etHD3Mp/czHxiLYRaZZvRBspVj0@DnrfhFPe1KmBT9SMnrHVxzpiU9A>
Date: Sun, 28 Dec 2008 00:02:51 +0300
From: Eygene Ryabinkin <rea-sec@...elabs.ru>
To: oss-security@...ts.openwall.com
Cc: atomo64+debian@...il.com
Subject: Re: CVE id request: verlihub
Steven, good day.
Wed, Dec 24, 2008 at 12:54:14PM -0500, Steven M. Christey wrote:
> ======================================================
> Name: CVE-2008-5706
> Status: Candidate
> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5706
> Reference: MILW0RM:7183
> Reference: URL:http://www.milw0rm.com/exploits/7183
> Reference: MLIST:[oss-security] 20081216 CVE id request: verlihub
> Reference: URL:http://openwall.com/lists/oss-security/2008/12/17/16
> Reference: MISC:http://bugs.debian.org/506530
>
> The cTrigger::DoIt function in src/ctrigger.cpp in the trigger
> mechanism in the daemon in Verlihub 0.9.8d-RC2 and earlier allows
> local users to overwrite arbitrary files via a symlink attack on the
> /tmp/trigger.tmp temporary file.
What about remote command execution via unsanitized user input? It
will work only if the server had executable triggers and 'allow_exec'
is set to 1. By the way, CVE-2008-5706 will be triggered ;)) only for
this case too.
If anyone is interested, I had reworked the original patch at MilW0rm.
Original patch was mangling results of std::string.c_str() and
sanitizing not only user-supplied part, but the whole command. The
result is attached and comments are very welcome.
--
Eygene
View attachment "patch-CVE-2008-5706" of type "text/plain" (2388 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
