oss-sec mailing list archives
Re: CVE request: procmail heap overflow in getlline()
From: Kurt Seifried <kseifried () redhat com>
Date: Thu, 04 Dec 2014 01:41:10 -0700
On 04/12/14 12:57 AM, Santiago Vila wrote:
On Wed, Dec 03, 2014 at 05:30:57PM -0600, Joshua J. Drake wrote:Is it possible to trigger this issue with untrusted input or only trusted input from procmailrc?This is an issue with the handling of .procmailrc file, which contains the filter rules for procmail. An external attacker is not supposed to provide the .procmailrc file at /home/user, only the email to be filtered, so, IMHO, this is a bug but maybe not a security bug. Thanks.
I disagree. Many mail servers allow people to edit their .procmailrc but explicitly block shell accounts. This would allow a user with a non interactive shell account to execute arbitrary commands using procmailrc even if they were otherwise restricted (e.g. using permissions or SELinux for example). I bet if gmail filters allowed code exec Google would seriously freak out and fix it asap =). -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- CVE request: procmail heap overflow in getlline() Henri Salo (Dec 03)
- Re: CVE request: procmail heap overflow in getlline() Joshua J. Drake (Dec 03)
- Re: CVE request: procmail heap overflow in getlline() Tero Marttila (Dec 03)
- Re: CVE request: procmail heap overflow in getlline() Santiago Vila (Dec 04)
- Re: CVE request: procmail heap overflow in getlline() Kurt Seifried (Dec 04)
- Re: CVE request: procmail heap overflow in getlline() Florian Weimer (Dec 04)
- Re: CVE request: procmail heap overflow in getlline() Martino Dell'Ambrogio (Dec 04)
- Re: CVE request: procmail heap overflow in getlline() Florian Weimer (Dec 04)
- Re: CVE request: procmail heap overflow in getlline() Martino Dell'Ambrogio (Dec 04)
- Re: CVE request: procmail heap overflow in getlline() Joshua J. Drake (Dec 03)