Bug 855029 (CVE-2012-4409)

Summary:	CVE-2012-4409 mcrypt: buffer overflow when processing encrypted file headers
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	tcallawa
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:59:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	855030, 855031
Bug Blocks:

Description Vincent Danen 2012-09-06 14:31:45 UTC

A buffer overflow was reported [1],[2] in mcrypt version 2.6.8 and earlier due to a boundary error in the processing of an encrypted file (via the check_file_head() function in src/extra.c).  If a user were tricked into attempting to decrypt a specially-crafted .nc encrypted flie, this flaw would cause a stack-based buffer overflow that could potentially lead to arbitrary code execution.

Note that this is caught by FORTIFY_SOURCE, which renders this to being a crash-only bug on Fedora.

There is currently no upstream patches for this flaw.

[1] https://secunia.com/advisories/50507/
[2] https://bugs.gentoo.org/show_bug.cgi?id=434112

Comment 1 Vincent Danen 2012-09-06 14:33:38 UTC

Created mcrypt tracking bugs for this issue

Affects: fedora-all [bug 855030]
Affects: epel-all [bug 855031]

Comment 2 Vincent Danen 2012-09-06 14:38:04 UTC

CVE requested:

http://www.openwall.com/lists/oss-security/2012/09/06/1

Comment 3 Vincent Danen 2012-09-06 20:37:24 UTC

CVE-2012-4409 assigned:

http://www.openwall.com/lists/oss-security/2012/09/06/4

Comment 4 Vincent Danen 2012-09-06 20:43:53 UTC

Preliminary patches and further info are here:

http://www.openwall.com/lists/oss-security/2012/09/06/8

It also has a fix for some format string issues as well, which should be applied as well.

Comment 5 Fedora Update System 2012-09-17 22:15:55 UTC

mcrypt-2.6.8-9.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2012-09-19 03:11:01 UTC

mcrypt-2.6.8-9.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2012-09-24 21:31:19 UTC

mcrypt-2.6.8-9.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2012-09-24 21:31:52 UTC

mcrypt-2.6.8-9.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2012-09-26 09:13:57 UTC

mcrypt-2.6.8-9.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Product Security DevOps Team 2019-06-10 10:59:16 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.