Bug 190942 - CVE-2006-1550 Dia multiple buffer overflows and string format vulnerabilities (CVE-2005-2966, CVE-2006-2480, CVE-2006-2453)
CVE-2006-1550 Dia multiple buffer overflows and string format vulnerabilities...
Status: CLOSED WONTFIX
Product: Fedora Legacy
Classification: Retired
Component: dia (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Fedora Legacy Bugs
impact=moderate, LEGACY, rh73, rh9, 1...
: Security
: 188108 (view as bug list)
Depends On: 192699 192830
Blocks:
  Show dependency treegraph
 
Reported: 2006-05-06 18:06 EDT by Marc Deslauriers
Modified: 2007-08-30 16:00 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-08-30 16:00:54 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Marc Deslauriers 2006-05-06 18:06:43 EDT
+++ This bug was initially created as a clone of Bug #187401 +++

Dia multiple buffer overflows

infamous41md discovered three buffer overflows in Dia's xfig importer.
The issues are caused by unchecked input from the xfig file.

The patch can be found here:
http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html


This issue also affects RHEL2.1

-- Additional comment from bressers@redhat.com on 2006-03-30 13:44 EST --
Created an attachment (id=127062)
Demo Exploit #1


-- Additional comment from bressers@redhat.com on 2006-03-30 13:44 EST --
Created an attachment (id=127063)
Demo Exploit #2


-- Additional comment from bressers@redhat.com on 2006-03-30 13:45 EST --
Created an attachment (id=127064)
Demo Exploit #3


-- Additional comment from caolanm@redhat.com on 2006-04-03 05:49 EST --
For bug 187559, RHEL-4 has been rebuilt and mkerrata re-ran#

dist-4E-errata-candidate dia-0.94-5.3


-- Additional comment from caolanm@redhat.com on 2006-04-04 03:36 EST --
dist-2.1AS-errata-candidate dia-0.88.1-3.2 has been respun and mkerrata run for
RHEL-2.1 to pick-up fixed buildroot.

-- Additional comment from caolanm@redhat.com on 2006-04-28 05:53 EST --
RHEL-4 packages rebuilt to avoid huge mem alloc on invalid record size and
mkerrata has been rerun for RHEL-4

dist-4E-errata-candidate dia-0.94-5.4

-- Additional comment from bugzilla@redhat.com on 2006-05-03 11:56 EST --

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2006-0280.html
Comment 1 Marc Deslauriers 2006-05-06 23:27:15 EDT
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Here are updated packages to QA.

7f2630052615cad2e86dce113fb09a8fbdf15064  7.3/dia-0.88.1-3.1.legacy.src.rpm
f24bb78d953e4a818528fe582d8c985d36f5d4d4  9/dia-0.90-11.1.legacy.src.rpm
60d8615212e807dd9579317b74046483eb850496  1/dia-0.92.2-1.1.legacy.src.rpm
ca3212f3c249d5ba8ed4e969428d98a38b265533  2/dia-0.92.2-3.1.1.legacy.src.rpm
0736cf8804b65194e12dcd87cd897ef446234cdb  3/dia-0.94-5.fc3.1.legacy.src.rpm

Downloads:

http://www.infostrategique.com/linuxrpms/legacy/7.3/dia-0.88.1-3.1.legacy.src.rpm
http://www.infostrategique.com/linuxrpms/legacy/9/dia-0.90-11.1.legacy.src.rpm
http://www.infostrategique.com/linuxrpms/legacy/1/dia-0.92.2-1.1.legacy.src.rpm
http://www.infostrategique.com/linuxrpms/legacy/2/dia-0.92.2-3.1.1.legacy.src.rpm
http://www.infostrategique.com/linuxrpms/legacy/3/dia-0.94-5.fc3.1.legacy.src.rpm

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEXWuALMAs/0C4zNoRAvyjAJ9ESKsU0KOTguO+uX3GHOpQwyAfFwCfXB50
OQLO9l0xn9bOq9vI1208/Ew=
=YxKR
-----END PGP SIGNATURE-----
Comment 2 Pekka Savola 2006-05-07 00:56:23 EDT
Two questions:

 - in RHL9, the patch appears to be commented out?  Does this package require to
be re-spun, or can this be fixed at build time?
 - Are we affected by CVE-2005-2966? RHEL hasn't patched it at least and
bugzilla search is not working properly so I can't check whether there is bz#
for it..

Other than that, looks good.
Comment 3 Marc Deslauriers 2006-05-07 10:13:22 EDT
Argh...thanks for noticing the commented out patch in rh9...

You're right. Looks like we're affected by CVE-2005-2966. I can't find a
bugzilla entry for it for RHEL either, but Debian has a patch we can use.

I'll respin these.
Comment 5 Marc Deslauriers 2006-05-12 19:28:02 EDT
*** Bug 188108 has been marked as a duplicate of this bug. ***
Comment 6 David Eisenstein 2006-05-27 19:38:56 EDT
Looks like there are more potential issues with dia than the CVE-2006-1550 issue
addressed by this bugzilla ticket.  Hans de Goede of the Fedora Security project
has fixed two format string vulnerabilities for the FE5 version of dia for two
new CVE's:

 *  CVE-2006-2480 - "Format string vulnerability in Dia 0.94 allows
    user-complicit attackers to cause a denial of service (crash) and
    possibly execute arbitrary code by triggering errors or warnings,
    as demonstrated via format string specifiers in a .bmp filename. 
    NOTE: the original exploit was demonstrated through a command line
    argument, but there are other mechanisms inputs that are automatically
    process by Dia, such as a crafted .dia file."  (See Bug #192535 for FE5;
    and Bug #192538 & Bug #192699 for FC4).

*   CVE-2006-2453 - Additional dia format string flaws ("** RESERVED **
    This candidate has been reserved ... yada yada yada").  (See Bug #192830 
    for FE5, and Bug #192699 for FC4).

I haven't checked the code yet, but I imagine if there are string format
vulnerabilities in dia, that they've been there for a long time, and therefore
fixes for CVE-2006-2453 and CVE-2006-2480 could be backported...
Comment 7 Jesse Keating 2007-08-30 16:00:54 EDT
Fedora Legacy project has ended.  These will not be fixed by Fedora Legacy.

Note You need to log in before you can comment on or make changes to this bug.