Bug 863091 (CVE-2015-8837)

Summary: CVE-2015-8837 fuseiso: Stack-based buffer overflow when scanning directory structure for absolute path entries
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: carnil, dkholia, fweimer, jrusnack, security-response-team, tcallawa, tomasz
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-06-17 06:25:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 862211    
Bug Blocks: 863103    

Description Jan Lieskovsky 2012-10-04 12:21:13 UTC 
A stack-based buffer overflow flaw was found in the way FuseISO, a FUSE module to mount ISO filesystem images, performed expanding of directories portions for absolute path filename entries. A remote attacker could provide a specially-crafted ISO file that, when mounted via fuseiso tool would lead to fuseiso binary crash or, potentially, arbitrary code execution with the privileges of the user running the fuseiso executable.

Note: Since the fuseiso binary on Fedora is compiled with FORTIFY_SOURCE protection enabled, this flaw would allow an attacker to cause fuseiso binary to crash only.

Acknowledgements:

This issue was discovered by Florian Weimer of Red Hat Product Security Team.
Comment 1 Jan Lieskovsky 2012-10-04 12:26:55 UTC 
This issue affects the versions of the fuseiso package, as shipped with Fedora release of 16 and 17.
Comment 2 tomasz 2015-03-11 07:44:21 UTC 
Debian bug #779047 brought me here: is there a PoC ISO file that causes this issue to happen?
Comment 3 Andrej Nemec 2016-03-30 08:35:23 UTC 
CVE assignment:

http://seclists.org/oss-sec/2016/q1/712