Bug 138462

Summary: CAN-2004-0947 buffer overflow in unarj
Product: Red Hat Enterprise Linux 2.1 Reporter: Josh Bressers <bressers>
Component: unarjAssignee: Lon Hohberger <lhh>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: medium    
Version: 2.1CC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,reported=20041109
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-01-12 18:38:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Proposed patch for the buffer overflow.
none
Proposed patch for the directory traversal issue.
none
Buffer overflow POC archive.
none
Directory traversal POC archive. none

Description Josh Bressers 2004-11-09 14:25:00 UTC 
This was reported to vendor-sec by Suse.

Recently some guy called "doubles" posted something about a directory
traversal bug in unarj to full-disclosure. While looking into that
issue I also found a buffer overflow. The problem is that the value of
'short entry_pos' in unarj.c:read_header() is not checked but later
used as offset into 'char filename[512]' when copying into a 512 byte
buffer on the stack in extract(). It's exploitable if the compiler
doesn't inline the extract() function in unarj.c.
Comment 1 Josh Bressers 2004-11-09 14:27:16 UTC 
Created attachment 106328 [details]
Proposed patch for the buffer overflow.
Comment 2 Josh Bressers 2004-11-09 14:27:39 UTC 
Created attachment 106329 [details]
Proposed patch for the directory traversal issue.
Comment 5 Josh Bressers 2004-11-09 15:05:30 UTC 
No embargo date has been set for this issue.
Comment 8 Mark J. Cox 2005-01-11 09:49:06 UTC 
Now public, removing embargo
Comment 9 Josh Bressers 2005-01-12 18:38:52 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-007.html