Bug 427197 (CVE-2007-6613) - CVE-2007-6613 libcdio: long Joliet file name buffer overflow
Summary: CVE-2007-6613 libcdio: long Joliet file name buffer overflow
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2007-6613
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://lists.gnu.org/archive/html/lib...
Whiteboard: impact=moderate,source=gentoo,reporte...
Depends On: 427198 427199 427200
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-01-02 08:49 UTC by Red Hat Product Security
Modified: 2019-06-08 12:26 UTC (History)
1 user (show)

Fixed In Version: 0.78.2-4.fc7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-05-29 06:55:12 UTC


Attachments (Terms of Use)

Description Lubomir Kundrak 2008-01-02 08:49:39 UTC
Description of problem:

A buffer overrun in cd-info and libcdio was uncovered when one reads a
disk/image with a long joilet filename. Please see URL [1] and the Gentoo
bugreport [2] for more information and the patch (should be in upstream CVS now).

Version-Release number of selected component (if applicable):

dist-f8-updates:libcdio-0.78.2-3.fc8    
dist-f9-build:libcdio-0.78.2-3.fc8
dist-fc7-updates:libcdio-0.78.2-2.fc7

Steps to Reproduce:

mkdir -p tmp/dir1
touch tmp/dir1/file_with_really_really_long_silly_name_to_test_iso_info_buffer
mkisofs -J -R -volid My_Image -o test.iso tmp
iso-info -l test.iso
  
Additional info:

A fair number of applications link against libcdio (and also Livna ones). Please
do the update for all affected branches as soon as possible!

kover-0:3-2.x86_64
oxine-0:0.7.0-1.fc8.x86_64
libcddb-0:1.3.0-2.fc8.i386
libcddb-0:1.3.0-2.fc8.x86_64
libcdio-devel-0:0.78.2-3.fc8.i386
libcdio-0:0.78.2-3.fc8.x86_64
libcdio-devel-0:0.78.2-3.fc8.x86_64
libcdio-0:0.78.2-3.fc8.i386
gstreamer-plugins-good-0:0.10.6-6.fc8.x86_64

Comment 3 Lubomir Kundrak 2008-01-02 09:21:13 UTC
Actually, this is not that serious. The applications that use libcdio are not
vulnerable, as the problem lies in iso-info program only.

Comment 4 Fedora Update System 2008-01-03 01:39:27 UTC
libcdio-0.78.2-4.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2008-01-03 01:42:15 UTC
libcdio-0.78.2-4.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Lubomir Kundrak 2008-01-03 21:54:27 UTC
This issue got CVE name CVE-2007-6613

Comment 7 Tomas Hoger 2008-01-04 07:29:53 UTC
Robert Buchholz pointed out that original patch has an issue:

The original patches are off by two in the size calculation, as they 
calculate
  strlen(psz_iso_name+1)
instead of
  strlen(psz_iso_name)+1

This was reported by bannedit.

Updates:
http://cvs.savannah.gnu.org/viewvc/libcdio/src/iso-info.c?root=libcdio&r1=1.36&r2=1.37
http://cvs.savannah.gnu.org/viewvc/libcdio/src/cd-info.c?root=libcdio&r1=1.150&r2=1.151


Discussion in the referenced Gentoo bug.


Comment 8 Adrian Reber 2008-01-04 10:17:52 UTC
I have fixed it in CVS and will make updates available for EL-5, F-7, F-8 and
rawhide.

Comment 9 Mark J. Cox 2008-02-04 11:50:26 UTC
this is top level bug for tracking this issue across all red hat products and
services, (reopening)

Comment 12 Red Hat Bugzilla 2009-10-23 19:05:25 UTC
Reporter changed to security-response-team@redhat.com by request of Jay Turner.


Note You need to log in before you can comment on or make changes to this bug.