Red Hat Bugzilla – Bug 1167548
CVE-2014-9471 coreutils: memory corruption flaw in parse_datetime()
Last modified: 2016-06-13 06:58:59 EDT
A memory corruption flaw was reported in parse_datetime(). If an application using parse_datetime(), such as touch or date, accepted untrusted input, it could cause the application to crash or, potentially, execute arbitrary code. Patch: http://debbugs.gnu.org/cgi/bugreport.cgi?msg=11;filename=date-tz-crash.patch;att=1;bug=16872 References: http://seclists.org/oss-sec/2014/q4/782 http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872
Created coreutils tracking bugs for this issue: Affects: fedora-all [bug 1167549]
I believe this vulnerability was already addressed in F20+ Fedora (e.g. http://pkgs.fedoraproject.org/cgit/coreutils.git/commit/?h=f20 , https://bugzilla.redhat.com/show_bug.cgi?id=1069657 ). I consider this as a corner case - actually the issue is there since 5.3.0 , so RHEL-5+ are affected. That's the primary reason why I fixed that only in F20+. I'm going to close the F20 one as duplicate and keeping the tracking one opened. F19 was not yet fixed, if you believe this is imporant enough to issue a fix for f19, I can do that. Still, RHEL5+ are affected as I said.
In coreutils 8.4 (shipped with RHEL5 and 6), this is limited to an indefinite hang and 100% CPU consumption. The affected function in coreutils 8.4 is get_date(). Reproducers: $ touch '--date=TZ="123"345" @1' $ date '--date=TZ="123"345" @1'
MITRE assigned CVE-2014-9471 to this issue: http://seclists.org/oss-sec/2015/q1/17
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.