Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1740464 (CVE-2019-14274) - CVE-2019-14274 mcpp: heap based buffer overflow in function do_msg() in support.c
Summary: CVE-2019-14274 mcpp: heap based buffer overflow in function do_msg() in suppo...
Keywords:
Status: NEW
Alias: CVE-2019-14274
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1740465 1743382
Blocks: 1740467
TreeView+ depends on / blocked
 
Reported: 2019-08-13 04:44 UTC by Dhananjay Arunesh
Modified: 2021-02-16 21:30 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Dhananjay Arunesh 2019-08-13 04:44:49 UTC
A vulnerability was found in MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in
support.c.

Reference:
https://sourceforge.net/p/mcpp/bugs/13/

Comment 1 Dhananjay Arunesh 2019-08-13 04:45:04 UTC
Created mcpp tracking bugs for this issue:

Affects: fedora-all [bug 1740465]

Comment 3 Marco Benatto 2019-08-19 15:49:34 UTC
External References:

https://sourceforge.net/p/mcpp/bugs/13/

Comment 6 Marco Benatto 2019-08-19 19:01:40 UTC
When mcpp application found multibyte characters when parsing the input file, it tries to show warning messages. The messages are shown via cwarn() function which further calls do_msg() with the error message itself formatted in printf-like format. The buffer containing the multibyte sequence is also passed as parameter for do_msg() which doesn't handle it gracefully. This causes a buffer overflow to happening during the output message formation, the overflow may cause low integrity and confidentiality impacts and eventually may lead to invalid memory access causing DoS.


Note You need to log in before you can comment on or make changes to this bug.