This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 144518 - CAN-2005-0087 alsa-lib disables stack protection for it's users
CAN-2005-0087 alsa-lib disables stack protection for it's users
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: alsa-lib (Show other bugs)
4.0
All Linux
medium Severity high
: ---
: ---
Assigned To: Brian Stein
impact=important
: Security
Depends On:
Blocks: FC3Update 142822
  Show dependency treegraph
 
Reported: 2005-01-07 16:45 EST by Brian Stein
Modified: 2013-03-01 00:14 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-02-15 04:25:07 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
patch to fix this issue (851 bytes, patch)
2005-01-07 16:45 EST, Arjan van de Ven
no flags Details | Diff

  None (edit)
Description Arjan van de Ven 2005-01-07 16:45:54 EST
Description of problem:
 
libasound.so will disable the stack execution protection for all the apps using
it, which is quite a big chunk of our desktop apps.
The cause is a bit of evil code in src/mixer/mixer.c

I will attach a patch to fix this.

Note that this is a rather serious security issue due to the effect of disabling
stack protection (both execshield segment and NX) for a wide range of
applications at once.
Comment 1 Arjan van de Ven 2005-01-07 16:45:54 EST
Created attachment 109498 [details]
patch to fix this issue
Comment 7 Mark J. Cox (Product Security) 2005-01-28 06:49:05 EST
I'm assigning this issue CAN-2005-0087 as it borderline qualifies for
a CVE name under the definition of "exposure".  Since this has the
potential to disable stack execution protection for a large number of
applications, it's violating a reasonable security stance for the
RHEL4 product.
Comment 8 Mark J. Cox (Product Security) 2005-02-15 04:25:07 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-033.html

Note You need to log in before you can comment on or make changes to this bug.