oss-security - Re: CVE Request -- rpcbind -- Insecure (predictable) temporary file use

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <107994660.114681275936671362.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Mon, 7 Jun 2010 14:51:11 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Guillem Jover <guillem@...ian.org>,
        Aníbal Monsalve Salazar <anibal@...ian.org>,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- rpcbind -- Insecure (predictable)
 temporary file use


----- "Steven M. Christey" <coley@...us.mitre.org> wrote:

> On Fri, 4 Jun 2010, Josh Bressers wrote:
> 
> > Please use CVE-2010-2061 for this.
> 
> My read of Guillem's report at
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583435#5 suggests that
> we might have two distinct issues here:
> 
> - "*any* user can craft those two files before the daemon has started for
> the first time, which the daemon will parse."  Nothing to do with
> symlinks.
> 
> - symlinks are followed on creation of those files
> 

I'd not thought of these problems like this. You're probably right as CVE
assignments are for cause, not fix. I was thinking more along the lines of
the fix (store the files somewhere users can't write to) than the problems
(which there are certainly two of).

Steve, I'll let you make the call, but I'm currently leaning toward two
IDs.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.