[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201108100947.26910.sgrubb@redhat.com>
Date: Wed, 10 Aug 2011 09:47:26 -0400
From: Steve Grubb <sgrubb@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Yves-Alexis Perez" <corsac@...ian.org>
Subject: Re: CVE request: perf: may parse user-controlled config file
On Tuesday, August 09, 2011 09:25:24 AM Yves-Alexis Perez wrote:
> On mar., 2011-08-09 at 09:18 -0400, Steve Grubb wrote:
> > And in recent kernels has an executable stack:
> > https://bugzilla.redhat.com/show_bug.cgi?id=704296
>
> We don't have access to that bug.
Its marked as a security bug and I guess its not been reclassified. The short of it is
this:
/usr/bin/eu-readelf -l /usr/bin/perf | grep STACK
If you get RWE for the permissions, its executable. If you get RW, then everything is
fine. While this itself is not exploitable, if there were any other problems then this
could be susceptible to putting shell code on the stack which should have been
banished long ago. IOW, the ease of exploit goes up since you don't need to defeat any
advanced security mechanisms like ASLR.
I have a number of security assessment utilities located here:
http://people.redhat.com/sgrubb/security/
that can scan systems looking for problems like this. Some are rpm centric because
once you find a problem you want to know the associated package, but they could be
easily modified for other packaging tools.
-Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
