Bug 167164
| Summary: | potential buffer overflow in tog-pegasus | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 4 | Reporter: | Brian Stein <bstein> |
| Component: | tog-pegasus | Assignee: | Brian Stein <bstein> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 4.0 | CC: | bstevens |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | RHEA-2005-494 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2005-10-05 13:44:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 156322 | ||
Actually, part of this is a bug in glibc-kernheaders / glibc gethost* functions:
RFC 1035 states, in Section 2.3.4, 'Size limits':
" labels 63 octets or less
names 255 octets or less
".
ie. host names up to 255 characters are supported by DNS and BIND,
yet in the glibc-kernheaders, we see :
asm/param.h:
#define MAXHOSTNAMELEN 64
Yet the POSIX limit is correct:
bits/posix1_lim.h:
#define _POSIX_HOST_NAME_MAX 255
So it looks like the linux headers have the wrong MAXHOSTNAMELEN
for DNS host names - it should be 256, not 64.
The code was using the linux MAXHOSTNAMELEN 64 setting
(from src/Common/Config.h), not the
#define PEGASUS_MAXHOSTNAMELEN 64
in src/Common/Platform_LINUX_IX64_GNU.h, which is used only for LSB platforms
if MAXHOSTNAMELEN is not defined.
I've now made the PEGASUS_MAXHOSTNAMELEN default to (_POSIX_HOST_NAME_LEN+1),
or 256 if _POSIX_HOST_NAME_LEN is not defined.
I've attempted to check every one of the hundreds of uses of gethostname
or gethostbyname in the code for this problem, and found only these
possible instances of the problem:
src/Pegasus/Common/SystemUnix.cpp, @line 562
src/Providers/ManagedSystem/OperatingSystem/OperatingSystem_linux.cpp, @line 174
src/Providers/ManagedSystem/Process/Process_linux.cpp, @line 783
These are now fixed in the new tog-pegasus-2.4.1-3.rhel4 version.
Fixed with tog-pegasus-2.4.1-4.rhel4 . An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHEA-2005-494.html |
Description of problem: #define PEGASUS_MAXHOSTNAMELEN 64 char hostName [PEGASUS_MAXHOSTNAMELEN]; ... if ((he = gethostbyname (hostName))) { strcpy (hostName, he->h_name); } afaik there is no guarantee that hostnames are shorter than 64 bytes