Bug 524671 (CVE-2008-1391)

Summary:	CVE-2008-1391 glibc: strfmon format string problem
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jakub, schwab, wnefal+redhatbugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://securityreason.com/achievement_securityalert/53
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-09-24 07:16:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	496386
Bug Blocks:

Description Jan Lieskovsky 2009-09-21 16:59:57 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1391 to
the following vulnerability:

Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.

References:
-----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1391
https://bugzilla.novell.com/show_bug.cgi?id=375315
http://www.securityfocus.com/bid/36443/references
http://securityreason.com/achievement_securityalert/67

Comment 2 Jan Lieskovsky 2009-09-21 17:06:06 UTC

Statement:

Red Hat does not consider this to be a security issue. Properly written
application should not use arbitrary untrusted data as part of the format
string passed to functions as strfmon or printf family functions.

Comment 3 Tomas Hoger 2009-09-23 16:47:47 UTC

Few more links for posterity:

Old and new "research advisory" for this problem:
  http://securityreason.com/achievement_securityalert/53
  http://securityreason.com/achievement_securityalert/67

Upstream bug reports:
  http://sourceware.org/bugzilla/show_bug.cgi?id=9707
  http://sourceware.org/bugzilla/show_bug.cgi?id=10600

Comment 5 Tomas Hoger 2011-02-04 19:11:40 UTC

glibc variants of this *BSD libc issues reported in SecurityReason Advisory 67 got separate CVE ids CVE-2009-4881 (bug #599095) and CVE-2009-4880 (bug #599070).