Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less

[Daniel Kahn Gillmor <dkg () fifthhorseman net>]

On 11/16/2014 07:15 AM, Robert Święcki wrote:
> To sum up: If somebody uses 'file' in an unconstrained OS environment
> on untrusted inputs, and he gets pwnd in the result, then it's not a
> security problem, it's an incompetence problem - and IMO it should be
> discussed elsewhere.

I think other people have made good points already that tools like
"file" and "strings" are routinely used on untrusted input, and so
deserve to be treated as part of the attack surface in a normal free
software operating system (and therefore vulnerabilities in them warrant
mention here on oss-security).

I'd like to present one other argument against the kind of distinction
that Robert suggests making here, though.

If "file" or "strings" (or libmagic or libbfd, respectively) are
considered as "private" tools that should only be run on trusted inputs,
then we are effectively creating an entirely new class of
vulnerabilities that we need to report and fix, which may not have any
resolution.  In particular, we would need to report vulnerabilities in
tools that use these "private" tools on public data.

For example:

 * roundcube (a webmail client) relies on libmagic1

 * rox-filer (a graphical filesystem browser) relies on /usr/bin/file

 * rkhunter (a tool for scanning potentially-malicious files for
rootkits) relies on /usr/bin/file.

The composable nature of unix-style tools means that a bug in one
component is very likely to be a security vulnerability.

And if our interest is in not overwhelming the list with vulnerability
assignments, then declaring certain tools "off-limits" or "only to be
run on trusted inputs" is actually likely to *increase* instead of
decrease the total number of vulnerability counts (since we would now
need to report vulnerabilities in packages like roundcube and rkhunter
and rox-filer for exposing file and libmagic to untrusted input), while
still not leaving our users any safer.

        --dkg

Attachment: signature.asc
Description: OpenPGP digital signature