Bug 1412613 (CVE-2017-5209) - CVE-2017-5209 libplist: base64decode buffer over-read via split encoded Apple Property List data
Summary: CVE-2017-5209 libplist: base64decode buffer over-read via split encoded Apple...
Status: CLOSED NOTABUG
Alias: CVE-2017-5209
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20170112,reported=2...
Keywords: Reopened, Security
Depends On: 1412614
Blocks: 1432966
TreeView+ depends on / blocked
 
Reported: 2017-01-12 12:47 UTC by Andrej Nemec
Modified: 2017-05-16 10:04 UTC (History)
3 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2017-05-16 10:04:30 UTC


Attachments (Terms of Use)

Description Andrej Nemec 2017-01-12 12:47:03 UTC
The base64decode function in base64.c in libimobiledevice libplist through 1.12
allows attackers to obtain sensitive information from process memory or cause a
denial of service (buffer over-read) via split encoded Apple Property List data.

Upstream bug:

https://github.com/libimobiledevice/libplist/issues/84

Upstream patch:

https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957

Comment 1 Andrej Nemec 2017-01-12 12:48:31 UTC
Created libplist tracking bugs for this issue:

Affects: fedora-all [bug 1412614]

Comment 2 Peter Robinson 2017-01-21 10:29:32 UTC
So this isn't a clean patch due to quite significant refactoring of the base64.c since the last release but looking at the git changelogs there may be other security related issues that should be pulled in too. eg:

commit ae8b7a0f1a5cf569f52f35fc1f113d0c4f354f6e
Author: Nikias Bassen <nikias@gmx.li>
Date:   Wed Dec 14 02:32:47 2016 +0100

    base64: Prevent use of strlen() in base64decode when input buffer size is known

commit 62bac060ed5ee6d64a71edf6cc627cc184ae87e5
Author: Filippo Bigarella <filippobigarella@gmail.com>
Date:   Mon Oct 31 02:43:15 2016 +0100

    base64: Prevent buffer overflow by not decoding blocks with less than 4 chars


Note You need to log in before you can comment on or make changes to this bug.