Bug 891577 (CVE-2012-6089, CVE-2012-6090)

Summary: CVE-2012-6089 CVE-2012-6090 pl: buffer overflows in path canonisation and expansion of file names with long paths
Product: [Other] Security Response Reporter: Petr Pisar <ppisar>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bagnara, jlieskov, jrusnack, mefoster, ppisar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
URL: https://lists.iai.uni-bonn.de/pipermail/swi-prolog/2012/009428.html
Whiteboard: impact=low,public=20121221,reported=20130103,source=redhat,cvss2=2.1/AV:L/AC:L/Au:N/C:N/I:N/A:P,rhel-6/pl=wontfix,fedora-all/pl=affected
Fixed In Version: SWI-Prolog 6.3.7, SWI-Prolog 6.2.5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-23 04:36:11 EDT Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 891666    
Bug Blocks: 891671    
Attachments:
Description Flags
Upstream fix for CVE-2012-6089
none
Upstream fix for CVE-2012-6090
none
5.10.2 fix for CVE-2012-6089
none
5.10.2 fix for CVE-2012-6090 none

Description Petr Pisar 2013-01-03 05:29:54 EST
Changelog for pl-6.2.5 reads:

 * FIXED: Possible buffer overrun in patch canonisation code.  Pushes
    pointers on an automatic array without checking for overflow.  Can be
    used for DoS attacks.  Will be extremely hard to make it execute
    arbitrary code.

  * SECURITY: Possible buffer overflows when expanding file-names with long
    paths.  Affects expand_file_name/2.  Can lead to crashes (DoS attacks)
    and possibly execution of arbitrary code if an attacker can control
    the names of the files searched for, e.g., if expand_file_name/2 is
    used in a directory to which an attacker can upload files for which
    he can control the name.

These fixes are implemented by upstream commits:


From a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c Mon Sep 17 00:00:00 2001
From: Jan Wielemaker <J.Wielemaker@cs.vu.nl>
Date: Sun, 16 Dec 2012 18:13:17 +0100
Subject: [PATCH] FIXED: Possible buffer overrun in patch canonisation code.

Pushes pointers on an automatic array without checking for overflow.
Can be used for DoS attacks.  Will be extremely hard to make it execute
arbitrary code.


From b2c88972e7515ada025e97e7d3ce3e34f81cf33e Mon Sep 17 00:00:00 2001
From: Jan Wielemaker <J.Wielemaker@cs.vu.nl>
Date: Sun, 16 Dec 2012 17:29:37 +0100
Subject: [PATCH] SECURITY: Possible buffer overflows when expanding
 file-names with long paths.  Affects expand_file_name/2.

Can lead to crashes (DoS attacks) and possibly execution of arbitrary
code if an attacker can control the names of the files searched for,
e.g., if expand_file_name/2 is used in a directory to which an attacker
can upload files for which he can control the name.


I believe the vulnerabilities exist in older pl.
Comment 1 Jan Lieskovsky 2013-01-03 10:20:08 EST
These issues affect the version of the pl package, as shipped with Red Hat Enterprise Linux 6.

--

These issues affect the versions of the pl package, as shipped with Fedora release of 16 and 17. Please schedule an update.
Comment 2 Jan Lieskovsky 2013-01-03 10:20:57 EST
Created pl tracking bugs for this issue

Affects: fedora-all [bug 891666]
Comment 3 Jan Lieskovsky 2013-01-03 10:40:16 EST
CVE request:
  http://www.openwall.com/lists/oss-security/2013/01/03/3
Comment 4 Jan Lieskovsky 2013-01-04 06:14:55 EST
Based on:
  http://www.openwall.com/lists/oss-security/2013/01/03/7

1) the CVE-2012-6089 identifier has been assigned to the "pl: Possible buffer overrun in patch canonisation code." issue and,
2) the CVE-2012-6090 identifier has been assigned to the "pl: Possible buffer overflows when expanding file-names with long paths" issue.
Comment 5 Petr Pisar 2013-01-04 06:32:21 EST
Created attachment 672370 [details]
Upstream fix for CVE-2012-6089
Comment 6 Petr Pisar 2013-01-04 06:33:02 EST
Created attachment 672371 [details]
Upstream fix for CVE-2012-6090
Comment 7 Petr Pisar 2013-01-04 08:01:09 EST
Created attachment 672401 [details]
5.10.2 fix for CVE-2012-6089
Comment 8 Petr Pisar 2013-01-04 08:01:48 EST
Created attachment 672402 [details]
5.10.2 fix for CVE-2012-6090
Comment 9 Fedora Update System 2013-01-14 21:23:58 EST
pl-5.10.2-9.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2013-01-14 21:36:06 EST
pl-6.0.2-4.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2013-01-14 21:37:38 EST
pl-6.0.2-5.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Tomas Hoger 2014-06-23 04:36:11 EDT
The pl packages in Red Hat Enterprise Linux 6 are only provided via Optional repository with limited support.  They are provided as dependency for the ppl-swiprolog prolog binding sub-package of the ppl (The Parma Polyhedra Library: a library of numerical abstractions) library, which is also only available via Optional.  These issues will not be fixed in Red Hat Enterprise Linux 6.

Statement:

The Red Hat Security Response Team has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.