Bug 233161 - CVE-2007-1536 file 4.20 fixes a heap overflow in that can result in arbitrary code execution
Summary: CVE-2007-1536 file 4.20 fixes a heap overflow in that can result in arbitrary...
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: file   
(Show other bugs)
Version: 4.4
Hardware: All
OS: Linux
high
high
Target Milestone: ---
: ---
Assignee: Martin Bacovsky
QA Contact:
URL:
Whiteboard: impact=moderate,source=debian,reporte...
Keywords: Security
Depends On:
Blocks: CVE-2007-1536 233337
TreeView+ depends on / blocked
 
Reported: 2007-03-20 18:50 UTC by Lubomir Kundrak
Modified: 2007-11-17 01:14 UTC (History)
1 user (show)

Fixed In Version: RHSA-2007-0124
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-03-23 10:08:19 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Patch supplied from Ubuntu (2.76 KB, patch)
2007-03-20 22:58 UTC, Josh Bressers
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0124 normal SHIPPED_LIVE Moderate: file security update 2007-03-23 10:08:16 UTC

Description Lubomir Kundrak 2007-03-20 18:50:46 UTC
Description of problem:

The ChangeLog states this:

2007-02-08 17:30 Christos Zoulas <christos@zoulas.com>

        * fix integer underflow in file_printf which can lead to
          to exploitable heap overflow (Jean-Sebastien Guay-Lero)

Christos clarifies further:


The crux of the problem is here:

-               if ((buf = realloc(ms->o.buf, len + 1024)) == NULL) {
-                       file_oomem(ms, len + 1024);
+               size = (ms->o.size - ms->o.left) + len + 1024;
+               if ((buf = realloc(ms->o.buf, size)) == NULL) {

Instead of allocating len + 1024 bytes on top of the previous size,
before the fix we allocated just len + 1024 bytes. So if the buffer
was let's say 4K, and we printed a string of len < 3K in this pass,
then we effectively decreased the size of the string instead of
growing it because of the realloc().

christos

Version-Release number of selected component (if applicable):

file-3.* is not affected.
RHEL-3, RHEL-4, RHEL-5, FC-5, FC-6

How reproducible:

No reproducer available.

Comment 3 Josh Bressers 2007-03-20 21:36:36 UTC
The upstream patch can be found here:
http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/dist/file/src/funcs.c.diff?r1=1.1.1.10&r2=1.1.1.11&f=h

Comment 4 Josh Bressers 2007-03-20 22:58:40 UTC
Created attachment 150541 [details]
Patch supplied from Ubuntu

I've not looked to see the differences from the upstream commit.  It's possible
this is a more complete patch.

Comment 6 Lubomir Kundrak 2007-03-21 11:01:40 UTC
I was wrong stating that RHEL-3 isaffected. It ships -3 version.

Comment 7 Mark J. Cox 2007-03-21 13:14:32 UTC
Note from Steven Christey from Mitre: "The original vendor disclosure credited
"Jean-Sebastien Guay-Lero," and this cascaded everywhere.  But it's most likely
"Jean-Sebastien Guay-Leroux," who's reported a few issues in the past."


Comment 8 Martin Bacovsky 2007-03-21 18:46:17 UTC
This issue should be fixed in file-4.10-3. The fix is based on ubuntu patch.

Comment 12 Red Hat Bugzilla 2007-03-23 10:08:19 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0124.html



Note You need to log in before you can comment on or make changes to this bug.