Bug 233161 - CVE-2007-1536 file 4.20 fixes a heap overflow in that can result in arbitrary code execution
CVE-2007-1536 file 4.20 fixes a heap overflow in that can result in arbitrary...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: file (Show other bugs)
4.4
All Linux
high Severity high
: ---
: ---
Assigned To: Martin Bacovsky
impact=moderate,source=debian,reporte...
: Security
Depends On:
Blocks: CVE-2007-1536 233337
  Show dependency treegraph
 
Reported: 2007-03-20 14:50 EDT by Lubomir Kundrak
Modified: 2007-11-16 20:14 EST (History)
1 user (show)

See Also:
Fixed In Version: RHSA-2007-0124
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-03-23 06:08:19 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Patch supplied from Ubuntu (2.76 KB, patch)
2007-03-20 18:58 EDT, Josh Bressers
no flags Details | Diff

  None (edit)
Description Lubomir Kundrak 2007-03-20 14:50:46 EDT
Description of problem:

The ChangeLog states this:

2007-02-08 17:30 Christos Zoulas <christos@zoulas.com>

        * fix integer underflow in file_printf which can lead to
          to exploitable heap overflow (Jean-Sebastien Guay-Lero)

Christos clarifies further:


The crux of the problem is here:

-               if ((buf = realloc(ms->o.buf, len + 1024)) == NULL) {
-                       file_oomem(ms, len + 1024);
+               size = (ms->o.size - ms->o.left) + len + 1024;
+               if ((buf = realloc(ms->o.buf, size)) == NULL) {

Instead of allocating len + 1024 bytes on top of the previous size,
before the fix we allocated just len + 1024 bytes. So if the buffer
was let's say 4K, and we printed a string of len < 3K in this pass,
then we effectively decreased the size of the string instead of
growing it because of the realloc().

christos

Version-Release number of selected component (if applicable):

file-3.* is not affected.
RHEL-3, RHEL-4, RHEL-5, FC-5, FC-6

How reproducible:

No reproducer available.
Comment 3 Josh Bressers 2007-03-20 17:36:36 EDT
The upstream patch can be found here:
http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/dist/file/src/funcs.c.diff?r1=1.1.1.10&r2=1.1.1.11&f=h
Comment 4 Josh Bressers 2007-03-20 18:58:40 EDT
Created attachment 150541 [details]
Patch supplied from Ubuntu

I've not looked to see the differences from the upstream commit.  It's possible
this is a more complete patch.
Comment 6 Lubomir Kundrak 2007-03-21 07:01:40 EDT
I was wrong stating that RHEL-3 isaffected. It ships -3 version.
Comment 7 Mark J. Cox (Product Security) 2007-03-21 09:14:32 EDT
Note from Steven Christey from Mitre: "The original vendor disclosure credited
"Jean-Sebastien Guay-Lero," and this cascaded everywhere.  But it's most likely
"Jean-Sebastien Guay-Leroux," who's reported a few issues in the past."
Comment 8 Martin Bacovsky 2007-03-21 14:46:17 EDT
This issue should be fixed in file-4.10-3. The fix is based on ubuntu patch.
Comment 12 Red Hat Bugzilla 2007-03-23 06:08:19 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0124.html

Note You need to log in before you can comment on or make changes to this bug.