Bug 727624 (CVE-2011-2895)
| Summary: | CVE-2011-2895 BSD compress LZW decoder buffer overflow | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | unspecified | CC: | ajax, kem, mkasik, ovasik, security-response-team | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2015-08-21 22:37:49 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 725760, 728442, 728443, 728444, 728445, 728447, 729317, 752934, 833925 | ||||||
| Bug Blocks: | 714279 | ||||||
| Attachments: |
|
||||||
|
Description
Tomas Hoger
2011-08-02 16:00:47 UTC
Following projects embed this BSD compress code and have fixed this issue already, either by aborting compression when code > free_ent is encountered, or by protecting against de_stack overflow in the while loop. ncompress - code > free_ent check http://ncompress.git.sourceforge.net/git/gitweb.cgi?p=ncompress/ncompress;a=blob;f=compress.c;h=c16e1239#l1167 gzip - code > free_ent check http://git.savannah.gnu.org/gitweb/?p=gzip.git;a=blob;f=unlzw.c;h=63f941c6#l297 libarchive - code > free_ent check http://code.google.com/p/libarchive/source/browse/trunk/libarchive/archive_read_support_filter_compress.c?r=3195#375 busybox's libarchive - code > free_ent check http://git.busybox.net/busybox/tree/archival/libarchive/decompress_uncompress.c?id=833d4e7f#n220 OpenBSD compress - stack overflow check http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/compress/zopen.c#rev1.17 It seems this fix never made it to other BSDs as FreeBSD or NetBSD. The version from NetBSD was used in older freetype versions for some time: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/log/src/lzw/zopen.c http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/lzw/zopen.c?id=a1c990a6#n251 freetype version in Red Hat Enterprise Linux 4 (2.1.9) contains the code and is affected by this issue. libXfont contains affected version of the code too: http://cgit.freedesktop.org/xorg/lib/libXfont/tree/src/fontfile/decompress.c?id=f29f1d68#n249 More details can be found in bug #725760. Heirloom mailx / nail lzw.c should be based on FreeBSD code: http://nail.cvs.sourceforge.net/viewvc/nail/nail/lzw.c?revision=1.4&view=markup#l511 The code is used to compress and decompress imap cache file and spam filter database, and is not used to decompress untrusted inputs. Created attachment 516375 [details] 4.3BSD compress.c Local copy of the file from: http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/usr.bin/compress/compress.c (In reply to comment #1) > busybox's libarchive - code > free_ent check > http://git.busybox.net/busybox/tree/archival/libarchive/decompress_uncompress.c?id=833d4e7f#n220 It seems I was wrong about busybox. Different code path is used for the first code word. I'll need to work on additional reproducers to test both code paths. (In reply to comment #5) > It seems I was wrong about busybox. Different code path is used for the first > code word. I'll need to work on additional reproducers to test both code > paths. This problem was previously fixed in ncompress as CVE-2006-1168, see bug #201919. busybox code based on ncompress. Making this public. (In reply to comment #1) > libXfont contains affected version of the code too: libXfont fixed upstream in version 1.4.4: http://lists.freedesktop.org/archives/xorg-announce/2011-August/001721.html http://lists.freedesktop.org/archives/xorg-announce/2011-August/001722.html http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d11ee5886e9d9ec610051a206b135a4cdc1e09a0 This issue has been addressed in libXfont packages in following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2011:1154 https://rhn.redhat.com/errata/RHSA-2011-1154.html This issue has been addressed in xorg-x11 packages in following products: Red Hat Enterprise Linux 4 Via RHSA-2011:1155 https://rhn.redhat.com/errata/RHSA-2011-1155.html This issue has been addressed in freetype packages in following products: Red Hat Enterprise Linux 4 Via RHSA-2011:1161 https://rhn.redhat.com/errata/RHSA-2011-1161.html This issue has been addressed in following products: Red Hat Enterprise Linux 5.6.Z - Server Only Via RHSA-2011:1834 https://rhn.redhat.com/errata/RHSA-2011-1834.html |