Bug 765812 (CVE-2011-4599)

Summary: CVE-2011-4599 icu: Stack-based buffer overflow by canonicalizing the given localeID
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: caolanm, erack, rajasekhar.maddala, sarjutambe, security-response-team, srl, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-08-02 05:03:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 766537, 766538, 766539, 766540, 766542, 833912    
Bug Blocks: 765833    
Attachments:
Description Flags
stashing RHEL-5 backport of equivalent fix none

Description Jan Lieskovsky 2011-12-09 14:08:09 UTC 
A stack-based buffer overflow flaw was found in the way ICU, the tools and utilities for developing with International Components for Unicode, performed variant canonicalization for the given locale identifier. A remote attacker could provide a specially-crafted locale representation, which once opened by an unsuspecting, local user in an application, linked against ICU library, could lead to crash of that application or possibly execute arbitrary code with the permissions of the user running the application. 

References:
[1] http://bugs.icu-project.org/trac/ticket/8984
    (upstream ticket)
[2] http://crbug.com/106441
    (Google Chrome bug, not public)
[3] http://codereview.chromium.org/8822005/
    (Google Chrome code review entry)
[4] http://codereview.chromium.org/8822005/patch/6001/7002
    (Google Chrome patch)
[5] http://www.openwall.com/lists/oss-security/2011/12/09/2
    (CVE Request)
Comment 2 Vincent Danen 2011-12-09 21:28:06 UTC 
This issue was assigned the name CVE-2011-4599:

http://seclists.org/oss-sec/2011/q4/490
Comment 5 Huzaifa S. Sidhpurwala 2011-12-12 09:55:00 UTC 
This issue affects the version of icu as shipped with Red Hat Enterprise Linux 5 and 6.

This issue affects the version of icu as shipped with Fedora release 15 and 16.
Comment 6 Caolan McNamara 2011-12-12 09:58:29 UTC 
Created attachment 545647 [details]
stashing RHEL-5 backport of equivalent fix
Comment 8 Huzaifa S. Sidhpurwala 2011-12-12 10:04:22 UTC 
Created icu tracking bugs for this issue

Affects: fedora-all [bug 766542]
Comment 10 errata-xmlrpc 2011-12-13 22:14:24 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2011:1815 https://rhn.redhat.com/errata/RHSA-2011-1815.html
Comment 12 sarju 2012-08-07 14:21:37 UTC 
check this issues is there any test case for this issues?
Comment 13 sarju 2012-08-07 14:23:17 UTC 
for this issues is there any test case?
Comment 14 Eike Rathke 2012-08-07 17:15:07 UTC 
The only information available is http://bugs.icu-project.org/trac/ticket/8984 and the patch attached there http://bugs.icu-project.org/trac/attachment/ticket/8984/canonicalize2.patch and the code mentioned http://bugs.icu-project.org/trac/browser/icu/trunk/source/common/uloc.cpp#L1808

From the code it looks like one would have to pass an oversized locale string with a variant set (that if stripped either leaves an empty or still oversized string) to the internal _canonicalize() function with a _ULOC_CANONICALIZE option set.
Comment 15 rajasekhar.maddala 2012-08-08 11:26:35 UTC 
Is there any existing ICU test sample to verify this fix?