oss-sec mailing list archives
Re: CVE id request: htop
From: "Steven M. Christey" <coley () linus mitre org>
Date: Fri, 14 Nov 2008 12:35:41 -0500 (EST)
Sorry Jan and Nico, I didn't follow up with you on this. There were some questions about whether this deserved a CVE, since THOUSANDS of programs dump output without considering whether they're writing to a terminal... or what they're writing to a terminal. For example, should the "cat" program become more terminal-aware and avoid sending dangerous sequences? Which of dozens of different terminal types should it avoid sending these sequences to? Should it get a new CVE every time it forgets about some other terminal? Not to mention "more" and "ls" and "grep" and many others. We were forced to flag Apache a number of years ago because it didn't filter certain dangerous characters from its logs. I always felt a bit funny about that one. Hopefully you see why this is an edge case for us. In this specific case, however, apparently top performs this behavior, it's clearly intended to run in a terminal, *and* a vendor is stating it's a security issue. So, CVE-2008-5076 has been assigned. - Steve ====================================================== Name: CVE-2008-5076 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5076 Reference: MLIST:[oss-security] 20081102 CVE id request: htop Reference: URL:http://www.openwall.com/lists/oss-security/2008/11/02/1 Reference: CONFIRM:http://bugs.debian.org/504144 Reference: XF:htop-processname-weak-security(46321) Reference: URL:http://xforce.iss.net/xforce/xfdb/46321 htop 0.7 writes process names to a terminal without sanitizing non-printable characters, which might allow local users to hide processes, modify arbitrary files, or have unspecified other impact via a process name with "crazy control strings."
Current thread:
- CVE id request: htop Nico Golde (Nov 02)
- Re: CVE id request: htop Jan Lieskovsky (Nov 14)
- Re: CVE id request: htop Steven M. Christey (Nov 14)
- Re: CVE id request: htop Nico Golde (Nov 15)
- Re: CVE id request: htop Steven M. Christey (Nov 14)
- Re: CVE id request: htop Jan Lieskovsky (Nov 14)