[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201406070301.s57312XT020241@linus.mitre.org>
Date: Fri, 6 Jun 2014 23:01:02 -0400 (EDT)
From: cve-assign@...re.org
To: mmcallis@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: PHP configure script and Lynis tool /tmp/ issues reported on full disclosure
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
>> 39 if [ "${OS}" = "AIX" ]; then
>> 40 TMPFILE=/tmp/lynis.$$
> We can make a CVE assignment corresponding to your disclosure of this
> lynis.$$ issue on oss-security. Use CVE-2014-3982. A CVE for this most
> likely won't (or shouldn't) have a
> http://seclists.org/fulldisclosure/2014/Jun/21 reference unless the
> original fulldisclosure author confirms the association.
We have heard from the original fulldisclosure author, and have
permission to continue with the public CVE assignments here. The new
status is that CVE-2014-3982 refers only to the above unsafe use of
/tmp/lynis.$$ on AIX. It's quite possible that Linux distributions
won't produce any security updates mapping to CVE-2014-3982.
A second CVE ID, CVE-2014-3986, refers to this separate vulnerability
on non-AIX platforms (i.e., any uname except for AIX):
TMPFILE=`mktemp /tmp/lynis.XXXXXX`
...
find ${I} -name "*.conf" -print >> ${TMPFILE}.unsorted
This apparently allows a straightforward symlink attack against the
${TMPFILE}.unsorted file. Credit for this discovery belongs to the
same author as in the http://seclists.org/fulldisclosure/2014/Jun/21
post.
(There are two CVE IDs because the provenance of the first full public
disclosure is not the same, and because the scope of CVE-2014-3982 had
already been defined.)
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTkn8OAAoJEKllVAevmvms5koH/RE9JjUTvar94cdrUd1XjlhJ
B+lJS7H4oBrceS1aKg1kNtl8vHwlg7WsUzHKs4Ou7KIWHWTem3aMlz5p2C33mdM5
4fyf0Cci6zg8vgkW1sTeKJaXtuZg/JddZwPv71ElcgR0WYxale+Esqy+EpAO1jNM
i9Tsx9+1cY7IUu2BMd3X8mDxugNNufUeIeOCls7QMAkWdiW38+Gbx11Wj7EUMK8m
PAuNuBVEVSsiA5GDSxaJr6ENTixip3O5PvCjB28txfJq0Si0xiBl2DgglxQ+eGRm
OpHhK3cFY2XPRAZeu303Lhdm6vPWKMUL2ZM4aotf6hxf4ss4RKrczA/QauagIas=
=7RvE
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
