Bug 233164 - (CVE-2007-1536) CVE-2007-1536 file 4.20 fixes a heap overflow in that can result in arbitrary code execution
CVE-2007-1536 file 4.20 fixes a heap overflow in that can result in arbitrary...
Status: CLOSED NEXTRELEASE
Product: Fedora
Classification: Fedora
Component: file (Show other bugs)
6
All Linux
high Severity high
: ---
: ---
Assigned To: Martin Bacovsky
impact=important,source=debian,report...
: Security
Depends On: 233161
Blocks:
  Show dependency treegraph
 
Reported: 2007-03-20 14:53 EDT by Lubomir Kundrak
Modified: 2007-11-30 17:11 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-03-30 05:08:11 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Lubomir Kundrak 2007-03-20 14:53:41 EDT
+++ This bug was initially created as a clone of Bug #233161 +++

Description of problem:

The ChangeLog states this:

2007-02-08 17:30 Christos Zoulas <christos@zoulas.com>

        * fix integer underflow in file_printf which can lead to
          to exploitable heap overflow (Jean-Sebastien Guay-Lero)

Christos clarifies further:


The crux of the problem is here:

-               if ((buf = realloc(ms->o.buf, len + 1024)) == NULL) {
-                       file_oomem(ms, len + 1024);
+               size = (ms->o.size - ms->o.left) + len + 1024;
+               if ((buf = realloc(ms->o.buf, size)) == NULL) {

Instead of allocating len + 1024 bytes on top of the previous size,
before the fix we allocated just len + 1024 bytes. So if the buffer
was let's say 4K, and we printed a string of len < 3K in this pass,
then we effectively decreased the size of the string instead of
growing it because of the realloc().

christos

Version-Release number of selected component (if applicable):

file-3.* is not affected.
RHEL-3, RHEL-4, RHEL-5, FC-5, FC-6

How reproducible:

No reproducer available.
Comment 1 Josh Bressers 2007-03-20 17:36:45 EDT
The upstream patch can be found here:
http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/dist/file/src/funcs.c.diff?r1=1.1.1.10&r2=1.1.1.11&f=h
Comment 2 Martin Bacovsky 2007-03-30 05:08:11 EDT
This issue should be fixed in file-4.19-2.fc6.

Note You need to log in before you can comment on or make changes to this bug.