[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201402081401.s18E1p2I003994@linus.mitre.org>
Date: Sat, 8 Feb 2014 09:01:51 -0500 (EST)
From: cve-assign@...re.org
To: abn@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> http://www.droidsec.org/advisories/2014/02/04/two-security-issues-found-in-the-android-sdk-tools.html
> First, the integer "n" is signed. Second, the "strtoul" function
> allows specifying whether or not the number is negative
> results in a vanilla stack buffer overflow.
Use CVE-2014-1909 for this issue with incorrect use of an integer
value.
> no authentication is required between the Client and Server
>
> 2.The ADB Server ... Among other things, it implements port forwarding
> and maintaining a persistent connection to devices connected to the
> host computer.
>
> these design decisions leave much to be desired.
There is no CVE assignment for this. Here, "no authentication is
required" is probably best considered an opportunity for security
enhancement. (For example, there are many other applications that
provide other types of port forwarding in other contexts, and don't
implement authentication.)
> Issue #2 - Lack of hardening when compiling for a host
>
> When investigating whether or not this particular issue was
> exploitable, it was determined that the "adb" binary supplied by
> Google does not contain two crucial modern protection mechanisms.
> Those are: non-executable stack protection and binary base
> randomization (PIE). Since these two protections are absent,
> exploiting this issue is trivial. A patch that adds these protections
> when compiling host binaries is included, though its is not well
> tested.
>
> It should also be noted that host compilation also seems to
> intentionally opt out of the FORTIFY_SOURCE protections. It's not
> clear why this is the case since the comment near this line of code
> references an internal only bug number.
There is currently no CVE assignment for this. Absense of these types
of protection mechanisms can have a CVE ID in some cases, but the CVE
project typically proceeds only in instances where an upstream vendor
chooses to make an announcement that this was a software mistake. An
example is CVE-2013-5057. A third-party report could be used in a
limited set of scenarios, e.g., a build process that has a list of
files requiring safe compilation options, with a typo in one of the
filenames. Similarly, if the available information is that the vendor
intentionally disabled this type of a protection mechanism, a CVE
assignment can't be made.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJS9jfCAAoJEKllVAevmvmsiqUIAMUIIWCkDc4ECZB7Ic2AM6VB
TKRl+AB5ZwBxvJzdr1IOvx1yg0dVdwHq6A/Fe+MGFr/SlVTGHOu4tIbBYCAmFlkM
QCtSEuIwLYaIo63Qw/SM7HDIcvmPDlcY9hqcH5g3GOHTA6s0j/nNG/w7N9uGjZrK
kw9CqjniX32cTUJdL2X1wrLlbc+BJlply5HkTMFseCRCd9WT4RBsENhPgBPOB64p
LZ0MzOTOD+l8uN6CDblURnP5uq7eZ8dyOJm3PVNA/xdyMe4i0wj7BaL83zHrCrya
JxKtEKTbNzt7SE++VXhv0HpZuy4BvH3A9QlWpJcbBg2mB3BCsp/kSzbr1fDLYbw=
=Nfx1
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
