Bug 855029 (CVE-2012-4409)

Summary: CVE-2012-4409 mcrypt: buffer overflow when processing encrypted file headers
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: tcallawa
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20120906,reported=20120906,source=gentoo,cvss2=5.1/AV:N/AC:H/Au:N/C:P/I:P/A:P,fedora-all/mcrypt=affected,epel-all/mcrypt=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 855030, 855031    
Bug Blocks:    

Description Vincent Danen 2012-09-06 10:31:45 EDT
A buffer overflow was reported [1],[2] in mcrypt version 2.6.8 and earlier due to a boundary error in the processing of an encrypted file (via the check_file_head() function in src/extra.c).  If a user were tricked into attempting to decrypt a specially-crafted .nc encrypted flie, this flaw would cause a stack-based buffer overflow that could potentially lead to arbitrary code execution.

Note that this is caught by FORTIFY_SOURCE, which renders this to being a crash-only bug on Fedora.

There is currently no upstream patches for this flaw.

[1] https://secunia.com/advisories/50507/
[2] https://bugs.gentoo.org/show_bug.cgi?id=434112
Comment 1 Vincent Danen 2012-09-06 10:33:38 EDT
Created mcrypt tracking bugs for this issue

Affects: fedora-all [bug 855030]
Affects: epel-all [bug 855031]
Comment 2 Vincent Danen 2012-09-06 10:38:04 EDT
CVE requested:

http://www.openwall.com/lists/oss-security/2012/09/06/1
Comment 3 Vincent Danen 2012-09-06 16:37:24 EDT
CVE-2012-4409 assigned:

http://www.openwall.com/lists/oss-security/2012/09/06/4
Comment 4 Vincent Danen 2012-09-06 16:43:53 EDT
Preliminary patches and further info are here:

http://www.openwall.com/lists/oss-security/2012/09/06/8

It also has a fix for some format string issues as well, which should be applied as well.
Comment 5 Fedora Update System 2012-09-17 18:15:55 EDT
mcrypt-2.6.8-9.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2012-09-18 23:11:01 EDT
mcrypt-2.6.8-9.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2012-09-24 17:31:19 EDT
mcrypt-2.6.8-9.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2012-09-24 17:31:52 EDT
mcrypt-2.6.8-9.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2012-09-26 05:13:57 EDT
mcrypt-2.6.8-9.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.