Re: Varnish - no CVE == bug regression

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



On 03/07/14 02:17 PM, Stefan Bühler wrote:
> On Thu, 03 Jul 2014 13:41:58 -0600 Kurt Seifried
> <kseifried () redhat com> wrote:

> > That also sounds like it needs a CVE then. You should not be able
> > to trivially DoS stuff, especially OOM, things should protect
> > themselves from OOM'ing especially if they accept user controlled
> > input from the network.
>
> And again "user controlled input"... a root shell also uses "user 
> controlled input".

No because there is no trust boundary violation. If the root user is
logged in at a terminal executing command as root, that's fine. If a
non root user who is not authorized (e.g. via sudo or a setuid
program) is logged in and executing stuff as root, that's a trust
boundary violation.

In this case it's pretty simple: the back end web servers are NOT
supposed to be able to shut down the varnish cache server (if this was
supposed to happen you'd have built a proper channel to do so). That
they can do so means it is a denial of service, and therefore a trust
boundary violation. Ergo it needs a CVE.

> regards, Stefan


- -- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJTteWXAAoJEBYNRVNeJnmTS70QAMqiFuTWJOPQOl+xJwT9nYrO
cI+E4/9X+wAfDePlEAPklYSh5m6afTT8xlx1IvpZXRWB7aYnjAc2+0n720gBPpUL
6GOtDiPrw2A5Gm8U/DC6DOm1xB13E33Ua1xQCCeHbbwJzsqhUXS7pheiu/MvYW7a
G1ve4vi1g+9IvvgjcibqfIrrAVBLknAqyPE+sJqrDtD51xo+mvFfhjXRUkscr1sr
PRw/ZA9/o76Q/mAnHVrPZt+H1ezjUaRjv/HR434vKKsB6uptp6FqXLdcYKV3DNGC
wVdGzPxFKPMV0w561ty7uiZbYorAXRJ5fHm8cURpNXSlHIJgsm5wC9h9znPWSczt
BsN6YJMQLoFVh8CsccZvhXEQ2QRb9q04zcjyhWKKl75cKcxc2wsSZuAPFf8l4Ou4
10JkCyIvsuRsqeLKaEbPKjKHvrQUvFy5YBgWDqvr3e22nwYTQsPLn4HZa1SwaJ0z
CHGxPTXfmZ8xhsRcEoZy/h/NBMF8oRhLMPnxuZZvo5vBnxtw9TaAtZ7I2WgbLRU0
EiB31mbVaiJkRsaSMLxgll/6YBP3j8Roib3oYGrcBIWHXnd5cX5mNdWC3KfeCF3k
Z1eJ/n2969Rp2kOuDWlWNuuRJ9xMyoET0shu8KkUibY1WjAE10c47dMNJFuwNKMw
di7pCcftSgS3tR2mHbRH
=qhco
-----END PGP SIGNATURE-----