oss-sec mailing list archives
Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE?
From: halfdog <me () halfdog net>
Date: Sat, 16 Jul 2011 11:38:15 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Steven M. Christey wrote:
Very rarely, we will cover "documented behavior" if there is sufficient evidence of widespread abuse/misuse of that behavior by admins, in which case the CVE description would emphasize the fact that it is the admin's "fault" or "misconception." I generally try to stay away from edge cases (such as this one) that could have a "snowball effect" of setting a precedent that could ultimately be used to argue for assigning too many low-priority CVEs to many issues. I would be inclined to avoid assigning a CVE for this issue unless someone can provide a realistic, relatively common scenario under which this would pose a significant security problem. Speaking of Apache, the well-known double-extension handling issue that enables arbitrary upload/execution of dangerous files like abc.php.gif also doesn't have a CVE [I don't think] for similar reasons, that it is well-documented behavior.
Understood. I've looked at the issue more closely and found a similar DOS-exploitable timerace and a buffer overwrite unrelated to this. Just for study, I'm currently trying to combine 3 timeraces + buffer overwrite + ROP to get code execution. Since apache will quite likely fix the other two issues, they have to touch the code anyway, so the symlink issue might be historic soon also. - -- http://www.halfdog.net/ PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFOIXgjxFmThv7tq+4RAsILAJ9PCl87wk/Ii5D3ewVytYa4aDGHWACfc72d V/3gP5Ga7RajR681LWs4t/c= =/V3r -----END PGP SIGNATURE-----
Current thread:
- Apache symlink issue: can documented behavior be a security problem and hence get a CVE? halfdog (Jul 12)
- Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? Mike O'Connor (Jul 12)
- Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? Josh Bressers (Jul 12)
- Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? Steven M. Christey (Jul 13)
- Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? halfdog (Jul 16)
- Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? Stefan Fritsch (Jul 16)
- Re: Apache symlink issue: can documented behavior be a security problem and hence get a CVE? Steven M. Christey (Jul 13)