Re: CVE Request: Planeshift buffer overflow

[Andres Gomez <agomez () fluidsignal com>]

Hi kurt,

The fact that only local user can modify program files doesn't mean there
is no security risk, there are a lot of examples but look at this:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4620

this is very similar, only local user can modify software files, but as
defined by Mitre this bug "allows user-assisted remote attackers to execute
arbitrary code", because an attacker can deceive a user to download and use
a specially crafted file. I accept the fact that "chatbubbles.xml" being a
configuration file makes it harder to be replaced, but still there is a
risk.

Thanks for the feedback,

Andres Gomez

2012/5/17 Kurt Seifried <kseifried () redhat com>

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 05/17/2012 03:29 PM, Andres Gomez wrote:
> > Planeshift is an online multiplayer role playing game which is
> > open source (http://en.wikipedia.org/wiki/PlaneShift_(video_game))
> > and "chatbubbles.xml" is a sort of configuration file for chat
> > windows inside the game, so I can't be changed directly by remote
> > users.
>
> It doesn't sounds like any security boundary is being crossed.
>
> If you can edit that file I'm guessing you can also modify the other
> game files (executables, libraries, etc.), so there is no escalation
> of privilege as far as I can tell. If the ifle is owned by a unique
> user (e.g. it's a local config thing) again, if you can edit a users
> files you already have access, so no escalation of privilege. If this
> is correct then I will not be assigning a CVE.
>
> - --
> Kurt Seifried Red Hat Security Response Team (SRT)
> PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iQIcBAEBAgAGBQJPtaKRAAoJEBYNRVNeJnmThwQP/iLSfGP5gGSQOIN8skNBns6S
> dr/Obla/Xjy1iADbIAuTTYcvvdp07HYlJANDN+VMKSPRQVpmhZhbr0hVq7FNsNZ9
> L2j2BW6kpde0PxhKV6hOpLjUOATgfNYg573XPZNUKU7qEqRVAFasYjqikEiGV+lq
> h63ISGt/bLVvTyZaJAqeUkZz6AWa9sQBYyJ4ixYatyuipA67dfD4bqkbpYwiYtV1
> uy7b24hvW4GTV4bkz3LbZUNxzJuxCn2fv/HCMbbgXV6zlbw9/IhGrQfSyYOGzcn3
> ZJtsByq+kzDDZdZ5QE3fGQRud0+5a4dc00cth9gyh76wHgfH6GGNDcdA3YVzcmBv
> 8rPR36LcUHvYCRLzn4+aP6A/y3FZOK++P/f5NofkuAMQsXmenGKhWuL3nex7LGRV
> NYfycw+T89F1wPK5EB6HN0xjmfSxDKgsajHKuV4iJ0EqPwA45zVEFeFSAgqMhVBi
> rVofuOF46iBeHYQHzW8tKU6y13+uC6kMh78U9ekFR1sAR5pYrot5BakBJkCsWUo7
> 6X6NVl68OXiDXo8TkI9/OuDJFI7VVnzj2ccsOVRmAB+DKIqqRa6BRvv5aZ50OpfA
> Q+0+0aPsLWJ7lMSDizvFDDw0PhdqPq3vkinBBKRVvSbs9UG1KnNt7ADzn7O7vigR
> dXWRpeRoRNhHO/dfQawV
> =Gbu8
> -----END PGP SIGNATURE-----

-- 
--
AVISO DE CONFIDENCIALIDAD:

Esta transmisión se entiende para uso del destinatario o la entidad a la 
que va dirigida y puede contener información confidencial o protegida por 
la ley. Si el lector de este mensaje no fuera el destinatario, considérese 
por este medio informado que la retención, difusión, o copia de este correo 
electrónico está estrictamente prohibida. Si recibe este mensaje por error, 
por favor notifique inmediatamente al emisor y destruya el original. Gracias

--
CONFIDENTIALITY NOTICE:

This transmission is intended for the use of the individual or entity to 
which it is addressed, and it may contain information that is confidential 
or privileged under law. If the reader of this message is not the intended 
recipient, you are hereby notified that retention, dissemination, 
distribution or copying of this e-mail is strictly prohibited. If you 
received this e-mail in error, please notify the sender immediately and 
destroy the original. Thank you.