Bug 570678 (CVE-2010-0055)

Summary:	CVE-2010-0055 xar: signature bypass vulnerability
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	matthias
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0055
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-07-08 16:25:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	570679
Bug Blocks:

Description Vincent Danen 2010-03-05 01:36:43 UTC

Braden Thomas of the Apple Security Team reported a signature verification bypass vulnerability in xar.  xar_open assumes that the checksum is stored at offset 0, however xar_signature_copy_signed_data uses the xar property "checksum/offset" to find the offset to the checksum when validating the signature.  Because of this, a modified xar archive can pass signature validation by putting the checksum for the modified TOC at offset 0, pointing "checksum/offset" to the non-modified checksum at a higher offset, and using the original, non-modified, signature.

The fix was incorported upstream with revision 225:

http://code.google.com/p/xar/source/detail?r=225

Comment 2 Vincent Danen 2010-03-05 01:40:58 UTC

This vulnerability affects all current releases of Fedora, as well as rawhide, EPEL4, and EPEL5.

Comment 3 Fedora Update System 2010-04-28 14:26:10 UTC

xar-1.5.2-6.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/xar-1.5.2-6.fc12

Comment 4 Fedora Update System 2010-04-28 14:26:15 UTC

xar-1.5.2-6.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/xar-1.5.2-6.fc13

Comment 5 Fedora Update System 2010-04-28 14:26:19 UTC

xar-1.5.2-6.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/xar-1.5.2-6.fc11

Comment 6 Fedora Update System 2010-04-28 14:26:23 UTC

xar-1.5.2-6.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/xar-1.5.2-6.el5

Comment 7 Fedora Update System 2010-05-12 17:56:23 UTC

xar-1.5.2-6.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2010-05-12 17:59:54 UTC

xar-1.5.2-6.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2010-05-12 18:01:23 UTC

xar-1.5.2-6.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2010-05-14 01:08:19 UTC

xar-1.5.2-6.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.