oss-sec mailing list archives
headintheclouds tmp vulns - also request for referees decision on tmp vulns in deployment tools
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 09 Sep 2014 00:46:22 -0600
So in theory this is software is used for docker provisioning thing, so there shouldn't be any users on the docker image while it's being deployed (or indeed any software pretty much at all), so part of me wants to say this shouldn't qualify for a CVE if used normally, however it is a pretty blatant tmp vuln. So for the sake of starting a conversation about tmp vulns on systems that shouldn't have any users or ways to exploit the tmp vuln I'm posting this one. Basically if a tree falls in the forest but no beavers were present does anyone care that a lumber jack might get squashed? https://pypi.python.org/pypi/headintheclouds headintheclouds-0.5.2/headintheclouds/tasks.py remote_scripts_directory = '/tmp/bootstrap_scripts' sudo('mkdir -p %s' % remote_scripts_directory) for path in sorted(scripts): filename = os.path.basename(path) remote_script = '%s/%s' % (remote_scripts_directory, filename) put('bootstrap/%s' % filename, remote_script, use_sudo=True) run('source %s' % remote_script) -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- headintheclouds tmp vulns - also request for referees decision on tmp vulns in deployment tools Kurt Seifried (Sep 08)