oss-sec mailing list archives
Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less
From: Daniel Kahn Gillmor <dkg () fifthhorseman net>
Date: Mon, 17 Nov 2014 11:30:15 -1000
On 11/16/2014 07:15 AM, Robert Święcki wrote:
To sum up: If somebody uses 'file' in an unconstrained OS environment on untrusted inputs, and he gets pwnd in the result, then it's not a security problem, it's an incompetence problem - and IMO it should be discussed elsewhere.
I think other people have made good points already that tools like "file" and "strings" are routinely used on untrusted input, and so deserve to be treated as part of the attack surface in a normal free software operating system (and therefore vulnerabilities in them warrant mention here on oss-security). I'd like to present one other argument against the kind of distinction that Robert suggests making here, though. If "file" or "strings" (or libmagic or libbfd, respectively) are considered as "private" tools that should only be run on trusted inputs, then we are effectively creating an entirely new class of vulnerabilities that we need to report and fix, which may not have any resolution. In particular, we would need to report vulnerabilities in tools that use these "private" tools on public data. For example: * roundcube (a webmail client) relies on libmagic1 * rox-filer (a graphical filesystem browser) relies on /usr/bin/file * rkhunter (a tool for scanning potentially-malicious files for rootkits) relies on /usr/bin/file. The composable nature of unix-style tools means that a bug in one component is very likely to be a security vulnerability. And if our interest is in not overwhelming the list with vulnerability assignments, then declaring certain tools "off-limits" or "only to be run on trusted inputs" is actually likely to *increase* instead of decrease the total number of vulnerability counts (since we would now need to report vulnerabilities in packages like roundcube and rkhunter and rox-filer for exposing file and libmagic to untrusted input), while still not leaving our users any safer. --dkg
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less, (continued)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Raphael Geissert (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Hanno Böck (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Robert Święcki (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Michal Zalewski (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Raphael Geissert (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Raphael Geissert (Nov 18)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Jakub Wilk (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Hanno Böck (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Jakub Wilk (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Alexander Cherepanov (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Robert Watson (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Robert Watson (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Michal Zalewski (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Hanno Böck (Nov 18)