Re: CVE request: procmail heap overflow in getlline()

[Florian Weimer <fweimer () redhat com>]

On 12/04/2014 11:26 AM, Martino Dell'Ambrogio wrote:
> For what is worth, I strongly believe this is a security bug for the
> same reason.
> As soon as there is an undocumented way to execute code, it will be
> impossible for a .procmailrc file generator to avoid execution of code.
> Workaround measures like security capabilities can not be taken into
> account as they are not implicit.

There are many documented code execution opportunities (some of them 
still rather subtle), so I find any arguments based on the existence of 
a hypothetical secure procmailrc file generator not very convincing.

:0
|echo code execution >/dev/tty

:0
* ?echo code execution >/dev/tty
/dev/null

… and so on.

--
Florian Weimer / Red Hat Product Security