Bug 440709 - (CVE-2008-1423) CVE-2008-1423 vorbis: integer oveflow caused by huge codebooks
CVE-2008-1423 vorbis: integer oveflow caused by huge codebooks
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
source=vendorsec,reported=20080318,pu...
: Security
Depends On: 444703 444704 444705 444706 444707 444708 446341 446342 446343 446344 833929
Blocks: 438125
  Show dependency treegraph
 
Reported: 2008-04-04 11:33 EDT by Tomas Hoger
Modified: 2016-01-26 08:32 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-06-19 06:47:59 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2008-04-04 11:33:10 EDT
Will Drewry of the Google Security Team reported an issue in OGG Vorbis library,
that can cause an integer overflow in the computation of quantvals and of the
space required for quantlist leading to a heap overflow.

Check for the overflow added in the fix.  Files are rejected if the total
virtual space of the codebook exceeds 24 bits.
Comment 1 Tomas Hoger 2008-04-04 11:33:57 EDT
Upstream patch:

$ svn log -r 14604 http://svn.xiph.org/trunk/vorbis/
------------------------------------------------------------------------
r14604 | xiphmont | 2008-03-19 09:03:29 +0100 (Wed, 19 Mar 2008) | 3 lines

dd checks/rejection for absurdly huge codebooks.

------------------------------------------------------------------------

$ svn diff -c 14604 http://svn.xiph.org/trunk/vorbis/
Index: lib/codebook.c
===================================================================
--- lib/codebook.c      (revision 14603)
+++ lib/codebook.c      (revision 14604)
@@ -159,6 +159,8 @@
   s->entries=oggpack_read(opb,24);
   if(s->entries==-1)goto _eofout;

+  if(_ilog(s->dim)+_ilog(s->entries)>24)goto _eofout;
+
   /* codeword ordering.... length ordered or unordered? */
   switch((int)oggpack_read(opb,1)){
   case 0:
Comment 3 Tomas Hoger 2008-04-28 09:28:48 EDT
https://trac.xiph.org/changeset/14604
Comment 6 Tomas Hoger 2008-05-14 03:30:44 EDT
Lifting embargo.
Comment 8 Fedora Update System 2008-05-14 06:47:53 EDT
libvorbis-1.2.0-4.fc9 has been submitted as an update for Fedora 9
Comment 9 Fedora Update System 2008-05-14 06:50:16 EDT
libvorbis-1.2.0-2.fc8 has been submitted as an update for Fedora 8
Comment 10 Fedora Update System 2008-05-14 06:51:45 EDT
libvorbis-1.1.2-4.fc7 has been submitted as an update for Fedora 7
Comment 11 Fedora Update System 2008-05-14 18:08:03 EDT
libvorbis-1.2.0-2.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2008-05-14 18:08:46 EDT
libvorbis-1.1.2-4.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Fedora Update System 2008-05-14 18:10:09 EDT
libvorbis-1.2.0-4.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.