Bug 427197 - (CVE-2007-6613) CVE-2007-6613 libcdio: long Joliet file name buffer overflow
CVE-2007-6613 libcdio: long Joliet file name buffer overflow
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://lists.gnu.org/archive/html/lib...
impact=moderate,source=gentoo,reporte...
: EasyFix, Patch, Security
Depends On: 427198 427199 427200
Blocks:
  Show dependency treegraph
 
Reported: 2008-01-02 03:49 EST by Red Hat Product Security
Modified: 2009-10-23 15:05 EDT (History)
1 user (show)

See Also:
Fixed In Version: 0.78.2-4.fc7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-05-29 02:55:12 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Lubomir Kundrak 2008-01-02 03:49:39 EST
Description of problem:

A buffer overrun in cd-info and libcdio was uncovered when one reads a
disk/image with a long joilet filename. Please see URL [1] and the Gentoo
bugreport [2] for more information and the patch (should be in upstream CVS now).

Version-Release number of selected component (if applicable):

dist-f8-updates:libcdio-0.78.2-3.fc8    
dist-f9-build:libcdio-0.78.2-3.fc8
dist-fc7-updates:libcdio-0.78.2-2.fc7

Steps to Reproduce:

mkdir -p tmp/dir1
touch tmp/dir1/file_with_really_really_long_silly_name_to_test_iso_info_buffer
mkisofs -J -R -volid My_Image -o test.iso tmp
iso-info -l test.iso
  
Additional info:

A fair number of applications link against libcdio (and also Livna ones). Please
do the update for all affected branches as soon as possible!

kover-0:3-2.x86_64
oxine-0:0.7.0-1.fc8.x86_64
libcddb-0:1.3.0-2.fc8.i386
libcddb-0:1.3.0-2.fc8.x86_64
libcdio-devel-0:0.78.2-3.fc8.i386
libcdio-0:0.78.2-3.fc8.x86_64
libcdio-devel-0:0.78.2-3.fc8.x86_64
libcdio-0:0.78.2-3.fc8.i386
gstreamer-plugins-good-0:0.10.6-6.fc8.x86_64
Comment 3 Lubomir Kundrak 2008-01-02 04:21:13 EST
Actually, this is not that serious. The applications that use libcdio are not
vulnerable, as the problem lies in iso-info program only.
Comment 4 Fedora Update System 2008-01-02 20:39:27 EST
libcdio-0.78.2-4.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2008-01-02 20:42:15 EST
libcdio-0.78.2-4.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Lubomir Kundrak 2008-01-03 16:54:27 EST
This issue got CVE name CVE-2007-6613
Comment 7 Tomas Hoger 2008-01-04 02:29:53 EST
Robert Buchholz pointed out that original patch has an issue:

The original patches are off by two in the size calculation, as they 
calculate
  strlen(psz_iso_name+1)
instead of
  strlen(psz_iso_name)+1

This was reported by bannedit.

Updates:
http://cvs.savannah.gnu.org/viewvc/libcdio/src/iso-info.c?root=libcdio&r1=1.36&r2=1.37
http://cvs.savannah.gnu.org/viewvc/libcdio/src/cd-info.c?root=libcdio&r1=1.150&r2=1.151


Discussion in the referenced Gentoo bug.
Comment 8 Adrian Reber 2008-01-04 05:17:52 EST
I have fixed it in CVS and will make updates available for EL-5, F-7, F-8 and
rawhide.
Comment 9 Mark J. Cox (Product Security) 2008-02-04 06:50:26 EST
this is top level bug for tracking this issue across all red hat products and
services, (reopening)
Comment 12 Red Hat Bugzilla 2009-10-23 15:05:25 EDT
Reporter changed to security-response-team@redhat.com by request of Jay Turner.

Note You need to log in before you can comment on or make changes to this bug.