Bug 1428883 (CVE-2017-6318)

Summary:	CVE-2017-6318 sane-backends: SANE_NET_CONTROL_OPTION response packet may contain memory contents of the server
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dkholia, mike, nphilipp, thibault.north, zdohnal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An information disclosure flaw was found in the way saned handled SANE_NET_CONTROL_OPTION requests. A remote attacker, able to connect to the saned daemon, could use this flaw to disclose portions of saned process memory.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-03-23 07:15:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1428885, 1428886
Bug Blocks:	1428884

Description Andrej Nemec 2017-03-03 14:52:17 UTC

When saned receives a SANE_NET_CONTROL_OPTION with value_type == SANE_TYPE_STRING and value_size larger than the actual length of the requested string, the response packet from the server contains a string object as long as value_size in the request. The bytes following the actual string appear to contain memory contents of the server.

Upstream bug:

https://alioth.debian.org/tracker/index.php?func=detail&aid=315576&group_id=30186&atid=410366

Upstream patch:

https://anonscm.debian.org/git/sane/sane-backends.git/commit/?id=42896939822b44f44ecd1b6

Comment 1 Andrej Nemec 2017-03-03 14:55:08 UTC

Created mingw-sane-backends tracking bugs for this issue:

Affects: fedora-all [bug 1428885]


Created sane-backends tracking bugs for this issue:

Affects: fedora-all [bug 1428886]

Comment 5 Dhiru Kholia 2017-03-23 07:30:20 UTC

Acknowledgments:

Name: the SANE project
Upstream: Kritphong Mongkhonvanit