oss-sec mailing list archives
Re: CVE request: perf: may parse user-controlled config file
From: Steve Grubb <sgrubb () redhat com>
Date: Wed, 10 Aug 2011 09:47:26 -0400
On Tuesday, August 09, 2011 09:25:24 AM Yves-Alexis Perez wrote:
On mar., 2011-08-09 at 09:18 -0400, Steve Grubb wrote:And in recent kernels has an executable stack: https://bugzilla.redhat.com/show_bug.cgi?id=704296We don't have access to that bug.
Its marked as a security bug and I guess its not been reclassified. The short of it is this: /usr/bin/eu-readelf -l /usr/bin/perf | grep STACK If you get RWE for the permissions, its executable. If you get RW, then everything is fine. While this itself is not exploitable, if there were any other problems then this could be susceptible to putting shell code on the stack which should have been banished long ago. IOW, the ease of exploit goes up since you don't need to defeat any advanced security mechanisms like ASLR. I have a number of security assessment utilities located here: http://people.redhat.com/sgrubb/security/ that can scan systems looking for problems like this. Some are rpm centric because once you find a problem you want to know the associated package, but they could be easily modified for other packaging tools. -Steve
Current thread:
- CVE request: perf: may parse user-controlled config file dann frazier (Aug 09)
- Re: CVE request: perf: may parse user-controlled config file Steve Grubb (Aug 09)
- Re: CVE request: perf: may parse user-controlled config file Yves-Alexis Perez (Aug 09)
- Re: CVE request: perf: may parse user-controlled config file Steve Grubb (Aug 10)
- Re: CVE request: perf: may parse user-controlled config file dann frazier (Aug 11)
- Re: CVE request: perf: may parse user-controlled config file Yves-Alexis Perez (Aug 09)
- Re: CVE request: perf: may parse user-controlled config file Josh Bressers (Aug 09)
- Re: CVE request: perf: may parse user-controlled config file Steve Grubb (Aug 09)