Re: Problems in automatic crash analysis frameworks

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> IMO two CVEs are required:
>
> "Various symlink flaws in abrt" and "Various race conditions in abrt"

For purposes of CVE, a set of vulnerabilities related to symlink
following normally isn't assigned two CVE IDs solely because some of
the symlink attacks depend on a race condition, whereas other symlink
attacks don't depend on a race condition.

The specific exploitation scenario disclosed in raceabrt.c is about
replacing maps with a symlink to /etc/passwd and then waiting for the
next line of the code to chown /etc/passwd. This requires symlink
following, and will have the same CVE ID as other issues that require
symlink following.

If the only goal of an attacker were to delete the maps file in order
to cause data loss, then we think that attacker does not need to win a
race. That attacker can delete the maps file either before or after
the chown. (It's also conceivable that file deletion, by itself, was
considered an acceptable risk, and not a valid attack goal.)

However, the text of
http://openwall.com/lists/oss-security/2015/04/14/4 said "is
vulnerable to a filesystem race where a user unlinks the file." That's
why we asked about the possibility of another scenario in which:

  1. The ultimate goal is only to unlink the file.
  2. Achieving this ultimate goal requires winning a race.

We think there's isn't any such scenario, but we wanted to confirm
that before doing a CVE mapping. If there isn't any such scenario,
then the total number of CVE IDs for the whole "Furthermore, Abrt
suffers" section will be 1.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJVL0V/AAoJEKllVAevmvmsNBgH/1cm1EzfPto2c5q9CF9fSd7v
MJ3O/53tfiuWGrWecFyFtn5NsAXb3t35TEioQe6EbDDmEO+ogN6xh+lBJSxc0hBI
+kTCjza08/6a1+vfgQaHX5zLdXUrA0BXi97Id1gfr+LcelSVMY0yoGfFlE/VvoKN
CXNiXu+FtukYMUSwIdmuHvTjmo54yPyMWI3bMRrw+Tt8X4KQq6mpUZKwNKQ8cOMb
1CVXIWSzs7cdVOEWe4xAeqKKbzhfclB4VB6uFRf/As5z6sWBcvY3sQMUfvvcw0yS
3rQ0LU90yq1rjnUGID4ckzFhV7o9h/AdshYrfi15SmdcR3G5TaKFs2fEkP5PZR0=
=h2Xd
-----END PGP SIGNATURE-----