Bug 891577 (CVE-2012-6089, CVE-2012-6090)
| Summary: | CVE-2012-6089 CVE-2012-6090 pl: buffer overflows in path canonisation and expansion of file names with long paths | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Petr Pisar <ppisar> | ||||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||||
| Status: | CLOSED WONTFIX | QA Contact: | |||||||||||
| Severity: | low | Docs Contact: | |||||||||||
| Priority: | low | ||||||||||||
| Version: | unspecified | CC: | bagnara, jlieskov, jrusnack, mefoster, ppisar | ||||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||||
| Target Release: | --- | ||||||||||||
| Hardware: | Unspecified | ||||||||||||
| OS: | Unspecified | ||||||||||||
| URL: | https://lists.iai.uni-bonn.de/pipermail/swi-prolog/2012/009428.html | ||||||||||||
| Whiteboard: | |||||||||||||
| Fixed In Version: | SWI-Prolog 6.3.7, SWI-Prolog 6.2.5 | Doc Type: | Bug Fix | ||||||||||
| Doc Text: | Story Points: | --- | |||||||||||
| Clone Of: | Environment: | ||||||||||||
| Last Closed: | 2014-06-23 08:36:11 UTC | Type: | Bug | ||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||
| Documentation: | --- | CRM: | |||||||||||
| Verified Versions: | Category: | --- | |||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||
| Embargoed: | |||||||||||||
| Bug Depends On: | 891666 | ||||||||||||
| Bug Blocks: | 891671 | ||||||||||||
| Attachments: |
|
||||||||||||
These issues affect the version of the pl package, as shipped with Red Hat Enterprise Linux 6. -- These issues affect the versions of the pl package, as shipped with Fedora release of 16 and 17. Please schedule an update. Created pl tracking bugs for this issue Affects: fedora-all [bug 891666] Based on: http://www.openwall.com/lists/oss-security/2013/01/03/7 1) the CVE-2012-6089 identifier has been assigned to the "pl: Possible buffer overrun in patch canonisation code." issue and, 2) the CVE-2012-6090 identifier has been assigned to the "pl: Possible buffer overflows when expanding file-names with long paths" issue. Created attachment 672370 [details] Upstream fix for CVE-2012-6089 Created attachment 672371 [details] Upstream fix for CVE-2012-6090 Created attachment 672401 [details] 5.10.2 fix for CVE-2012-6089 Created attachment 672402 [details] 5.10.2 fix for CVE-2012-6090 pl-5.10.2-9.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. pl-6.0.2-4.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. pl-6.0.2-5.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report. The pl packages in Red Hat Enterprise Linux 6 are only provided via Optional repository with limited support. They are provided as dependency for the ppl-swiprolog prolog binding sub-package of the ppl (The Parma Polyhedra Library: a library of numerical abstractions) library, which is also only available via Optional. These issues will not be fixed in Red Hat Enterprise Linux 6. Statement: The Red Hat Security Response Team has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. |
Changelog for pl-6.2.5 reads: * FIXED: Possible buffer overrun in patch canonisation code. Pushes pointers on an automatic array without checking for overflow. Can be used for DoS attacks. Will be extremely hard to make it execute arbitrary code. * SECURITY: Possible buffer overflows when expanding file-names with long paths. Affects expand_file_name/2. Can lead to crashes (DoS attacks) and possibly execution of arbitrary code if an attacker can control the names of the files searched for, e.g., if expand_file_name/2 is used in a directory to which an attacker can upload files for which he can control the name. These fixes are implemented by upstream commits: From a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c Mon Sep 17 00:00:00 2001 From: Jan Wielemaker <J.Wielemaker.nl> Date: Sun, 16 Dec 2012 18:13:17 +0100 Subject: [PATCH] FIXED: Possible buffer overrun in patch canonisation code. Pushes pointers on an automatic array without checking for overflow. Can be used for DoS attacks. Will be extremely hard to make it execute arbitrary code. From b2c88972e7515ada025e97e7d3ce3e34f81cf33e Mon Sep 17 00:00:00 2001 From: Jan Wielemaker <J.Wielemaker.nl> Date: Sun, 16 Dec 2012 17:29:37 +0100 Subject: [PATCH] SECURITY: Possible buffer overflows when expanding file-names with long paths. Affects expand_file_name/2. Can lead to crashes (DoS attacks) and possibly execution of arbitrary code if an attacker can control the names of the files searched for, e.g., if expand_file_name/2 is used in a directory to which an attacker can upload files for which he can control the name. I believe the vulnerabilities exist in older pl.