Bug 167164 - potential buffer overflow in tog-pegasus
potential buffer overflow in tog-pegasus
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: tog-pegasus (Show other bugs)
4.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Brian Stein
: Security
Depends On:
Blocks: 156322
  Show dependency treegraph
 
Reported: 2005-08-31 05:02 EDT by Brian Stein
Modified: 2013-03-01 00:14 EST (History)
1 user (show)

See Also:
Fixed In Version: RHEA-2005-494
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-10-05 09:44:22 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Arjan van de Ven 2005-08-31 05:02:13 EDT
Description of problem:

#define PEGASUS_MAXHOSTNAMELEN 64

    char hostName [PEGASUS_MAXHOSTNAMELEN];

...

    if ((he = gethostbyname (hostName)))
    {
       strcpy (hostName, he->h_name);
    }


afaik there is no guarantee that hostnames are shorter than 64 bytes
Comment 1 Jason Vas Dias 2005-08-31 20:23:35 EDT
Actually, part of this is a bug in glibc-kernheaders / glibc gethost* functions:
RFC 1035 states, in Section 2.3.4, 'Size limits':
"   labels        63 octets or less
    names         255 octets or less
".
ie. host names up to 255 characters are supported by DNS and BIND,
yet in the glibc-kernheaders, we see :

asm/param.h:
#define   MAXHOSTNAMELEN       64

Yet the POSIX limit is correct:

bits/posix1_lim.h:
#define  _POSIX_HOST_NAME_MAX  255

So it looks like the linux headers have the wrong MAXHOSTNAMELEN 
for DNS host names - it should be 256, not 64.

The code was using the linux MAXHOSTNAMELEN 64 setting
(from src/Common/Config.h), not the
#define PEGASUS_MAXHOSTNAMELEN 64 
in src/Common/Platform_LINUX_IX64_GNU.h, which is used only for LSB platforms
if MAXHOSTNAMELEN is not defined.

I've now made the PEGASUS_MAXHOSTNAMELEN default to (_POSIX_HOST_NAME_LEN+1),
or 256 if _POSIX_HOST_NAME_LEN is not defined.

I've attempted to check every one of the hundreds of uses of gethostname
or gethostbyname in the code for this problem, and found only these
possible instances of the problem: 

src/Pegasus/Common/SystemUnix.cpp, @line 562
src/Providers/ManagedSystem/OperatingSystem/OperatingSystem_linux.cpp, @line 174
src/Providers/ManagedSystem/Process/Process_linux.cpp, @line 783

These are now fixed in the new tog-pegasus-2.4.1-3.rhel4 version.
Comment 2 Jason Vas Dias 2005-09-01 07:14:02 EDT
Fixed with tog-pegasus-2.4.1-4.rhel4 .
Comment 3 Red Hat Bugzilla 2005-10-05 09:44:23 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHEA-2005-494.html

Note You need to log in before you can comment on or make changes to this bug.