Bug 902853

Summary:	webalizer: stack-based buffer overflow by importing cache from tab file
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jorton, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:59:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1099872
Bug Blocks:	902874

Description Jan Lieskovsky 2013-01-22 14:30:52 UTC

A stack-based buffer overflow flaw was found in the way Webalizer, a flexible web server log file analysis program, performed import of its cache from certain tab files. A remote attacker could provide a specially-crafted tab file that, when imported would lead to wcmgr executable crash or, potentially, arbitrary code execution with the privileges of the user running the wcmgr binary.

Comment 1 Jan Lieskovsky 2013-01-22 14:33:27 UTC

This issue was discovered by Murray McAllister of Red Hat Security Response Team.

Comment 2 Jan Lieskovsky 2013-01-22 14:36:19 UTC

This issue did NOT affect the version of the webalizer package, as shipped with Red Hat Enterprise Linux 5.

--

This issue affects the version of the webalizer package, as shipped with Red Hat Enterprise Linux 6.

--

This issue affects the version of the webalizer package, as shipped with Fedora release of 16, 17, and 18.

Comment 5 Tomas Hoger 2014-05-21 11:48:27 UTC

This was fixed upstream in between webalizer-2.23-05 and webalizer-2.23-08, where relevant sscanf now is:

  i = sscanf(buffer,"%47s\t%lu\t%d\t%" SMAXHOST "s",

Comment 6 Tomas Hoger 2014-05-21 11:49:06 UTC

Created webalizer tracking bugs for this issue:

Affects: fedora-all [bug 1099872]

Comment 7 Fedora Update System 2014-09-09 22:15:23 UTC

webalizer-2.23_08-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.