CVE-2006 entries added

[Chris Ricker]

FYI, I did a very simple and dumb (my specialty!) comparison of all the 
packages in the FE5 CVS tree with the CVE-2006-* database

A couple of the packages I don't have time to enter right now (seamonkey 
being the real biggie) but for the ones I had time to get to, I've updated 
the fe4 and fe5 lists in CVS and filed bugzillas for a couple of packages 
that appear to have unresolved vulnerabilities. Overall Fedora Extras 
looked pretty good....

Packages which at least match between FE4 / FE5 and CVE-2006* that I've 
not looked into fully yet:

bsd-games
clamav
nethack
seamonkey
wine

I'll get to them later in the week

Do people see a need to extend this back any further, or is CVE-2006 a 
good line to draw as a beginning for when we track CVE?

later,
chris

[Jason L Tibbitts III]

> >>>> "CR" == Chris Ricker
> <kaboom(a)oobleck.net&gt; writes: 
CR> bsd-games

I know the package owner did a lot of work on this package to minimize
security issues; I'm pretty sure it didn't make it into the repo with
any known problems.

CR> clamav

I think all known issues are solved with the latest update (unless any
new ones have come in in the past week.

CR> nethack

Same issue as with bsd-games.

CR> Do people see a need to extend this back any further, or is
CR> CVE-2006 a good line to draw as a beginning for when we track CVE?

It's a good an arbitrary point as any, I suppose.  Perhaps half-way
back through 2005 would be more complete, but I don't know if it would
be worth the valuable time of a volunteer.

 - J<

[Ville Skyttä]

On Mon, 2006-05-08 at 17:11 -0500, Jason L Tibbitts III wrote:
>  >>>>> "CR" == Chris Ricker
> <kaboom(a)oobleck.net&gt; writes:
>  
>  CR> bsd-games
>  
>  I know the package owner did a lot of work on this package to minimize
>  security issues; I'm pretty sure it didn't make it into the repo with
>  any known problems. 
IIRC the problem was in sail, and I checked during the review that the
fix was in (as part of the patch borrowed from Debian).  So unless it
was dropped later for some reason, I believe this is ok.

[Luke Macken]

On Mon, May 08, 2006 at 05:11:18PM -0500, Jason L Tibbitts III wrote:
>  CR> nethack
>  
>  Same issue as with bsd-games. 
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187353

This ball is in my court.  As mentioned in the bug report, this issue
only applies when users are a part of the 'games' group.  As far as I
know, this issue has not been fixed anywhere (even in gentoo where it
is actually a real issue, since people are encouraged to join the
'games' group).


luke

[Hans de Goede]

Luke Macken wrote:
>  On Mon, May 08, 2006 at 05:11:18PM -0500, Jason L Tibbitts III
> wrote:
> > CR> nethack
> >
> > Same issue as with bsd-games.
>  
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187353
>  
>  This ball is in my court.  As mentioned in the bug report, this issue
>  only applies when users are a part of the 'games' group.  As far as I
>  know, this issue has not been fixed anywhere (even in gentoo where it
>  is actually a real issue, since people are encouraged to join the
>  'games' group).
>   
Although users are not in the games group on Fedora this is still a 
problem, this hole allows the following scenario:
- find a sgid game which is exploitable to get games gid rights
- use the games gid rights to drop a crafted file which will
   exploit nethack when opened by nethack.
- once another users runs nethack and opens the crafted file
   unwanted things get done with the rights of the other user.

So although low priority this needs fixing never the less.

Regards,

Hans

[Andreas Bierfert]

On Mon, 8 May 2006 16:31:57 -0400 (EDT)
Chris Ricker <kaboom(a)oobleck.net&gt; wrote:
>  Packages which at least match between FE4 / FE5 and CVE-2006* that
> I've 
>  not looked into fully yet: 
[...]
>  wine 
Hm what would that be?

- Andreas
-- 
Andreas Bierfert               | http://awbsworld.de      | GPG: C58CF1CB
andreas.bierfert(a)lowlatency.de | http://lowlatency.de     | signed/encrypted
phone: [phone]         | cell: [phone]    | mail preferred

[Chris Ricker]

On Wed, 17 May 2006, Andreas Bierfert wrote:

>  On Mon, 8 May 2006 16:31:57 -0400 (EDT)
>  Chris Ricker <kaboom(a)oobleck.net&gt; wrote:
>  > Packages which at least match between FE4 / FE5 and CVE-2006* that I've 
>  > not looked into fully yet:
>  [...]
>  > wine
>  
>  Hm what would that be? 
CVE-2006-0106 - it's not a problem for any maintained Extras branch

later,
chris

[Andreas Bierfert]

On Wed, 17 May 2006 09:28:38 -0400 (EDT)
>  CVE-2006-0106 - it's not a problem for any maintained Extras
> branch 
Thats what I tought ;) Just checking...

- Andreas

-- 
Andreas Bierfert               | http://awbsworld.de      | GPG: C58CF1CB
andreas.bierfert(a)lowlatency.de | http://lowlatency.de     | signed/encrypted
phone: [phone]         | cell: [phone]    | mail preferred