[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTikv-wp3eViKJk1wLk1WJHS0=09PRNA7SV4uTSP=@mail.gmail.com>
Date: Mon, 28 Feb 2011 15:26:41 -0500
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: FreeBSD/OS X crontab information leakage
Details here:
http://marc.info/?l=full-disclosure&m=129891323028897&w=2
There are three leaks, each of which amounts to a minor DAC bypass.
1. Leakage of file/directory existence via stat() calls (e.g.
determining if a file exists regardless of search permissions on
directories)
2. Leakage of directory existence via realpath()
3. Arbitrary MD5 comparison (e.g. ability to determine if any two
files have identical MD5 hashes, regardless of read permissions on
those files)
No preference for single vs. multiple CVEs.
-Dan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
