Re: CVE request: procmail heap overflow in getlline()

[Kurt Seifried <kseifried () redhat com>]

On 04/12/14 12:57 AM, Santiago Vila wrote:
> On Wed, Dec 03, 2014 at 05:30:57PM -0600, Joshua J. Drake wrote:
> > Is it possible to trigger this issue with untrusted input or only
> > trusted input from procmailrc?
>
> This is an issue with the handling of .procmailrc file, which contains
> the filter rules for procmail. An external attacker is not supposed to
> provide the .procmailrc file at /home/user, only the email to be
> filtered, so, IMHO, this is a bug but maybe not a security bug.
>
> Thanks.

I disagree. Many mail servers allow people to edit their .procmailrc but
explicitly block shell accounts. This would allow a user with a non
interactive shell account to execute arbitrary commands using procmailrc
even if they were otherwise restricted (e.g. using permissions or
SELinux for example). I bet if gmail filters allowed code exec Google
would seriously freak out and fix it asap =).



-- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Attachment: signature.asc
Description: OpenPGP digital signature