Bug 1039390 (CVE-2013-7039)

Summary:	CVE-2013-7039 libmicrohttpd: stack overflow in MHD_digest_auth_check()
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fweimer, jrusnack, pfrields, systemd-maint, tim, vpavlin
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-29 13:46:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1034363, 1039391, 1039392, 1039393
Bug Blocks:

Description Murray McAllister 2013-12-09 01:56:01 UTC

A stack overflow flaw was found in the MHD_digest_auth_check() function in libmicrohttpd. If MHD_OPTION_CONNECTION_MEMORY_LIMIT was configured to allow large allocations, a remote attacker could possibly use this flaw to cause an application using libmicrohttpd to crash or, potentially, execute arbitrary code with the privileges of the user running the application. This issue has been resolved in version 0.9.32.

References:
https://gnunet.org/svn/libmicrohttpd/ChangeLog
http://secunia.com/advisories/55903/
https://bugs.gentoo.org/show_bug.cgi?id=493450

Acknowledgements:

This issue was discovered by Florian Weimer of the Red Hat Product Security Team.

Comment 2 Murray McAllister 2013-12-09 01:57:50 UTC

Created libmicrohttpd tracking bugs for this issue:

Affects: fedora-all [bug 1039391]
Affects: epel-all [bug 1039392]

Comment 3 Murray McAllister 2013-12-09 02:06:33 UTC

CVE request: http://www.openwall.com/lists/oss-security/2013/12/09/1