oss-sec mailing list archives
Re: Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability
From: Seth Arnold <seth.arnold () canonical com>
Date: Thu, 6 Nov 2014 17:27:28 -0800
On Thu, Nov 06, 2014 at 08:00:33PM -0500, cve-assign () mitre org wrote:
A format string vulnerability vuln has been found in the latest version of dpkg. https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1389135
Use CVE-2014-8625. We're aware of "does not show evidence of allowing attackers to cross privilege boundaries" in https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1389135/comments/2 -- we'll certainly look for any discussion on this list that disputes the CVE.
The build recipes in Debian packaging are all-powerful; they run arbitrary commands and executables with full privileges of the user building the package. The maintainer scripts in Debian binary packages are all-powerful; they run arbitrary commands and executables with root privileges when packages are installed. There is no need to resort to format string vulnerabilities in control files to execute malicious code in an untrusted package. It would be easier and more reliable to simply put malicious code directly in the debian/rules file or postinst scripts. It is not safe to build packages from untrusted sources. It is not safe to install packages from untrusted sources. This is why we did not assign a CVE from Ubuntu's CVE pool. Thanks
Attachment:
signature.asc
Description: Digital signature
Current thread:
- CVE-Request: dpkg handling of 'control' and warnings format string vulnerability Joshua Rogers (Nov 05)
- Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability cve-assign (Nov 06)
- Re: Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability Seth Arnold (Nov 06)
- Re: Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability Joshua Rogers (Nov 06)
- Re: Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability Sven Kieske (Nov 07)
- Re: Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability Joshua Rogers (Nov 07)
- Re: Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability Seth Arnold (Nov 06)
- Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability cve-assign (Nov 06)
- Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability Joshua Roers (Nov 15)