Bug 765812 (CVE-2011-4599) - CVE-2011-4599 icu: Stack-based buffer overflow by canonicalizing the given localeID
Summary: CVE-2011-4599 icu: Stack-based buffer overflow by canonicalizing the given lo...
Status: CLOSED ERRATA
Alias: CVE-2011-4599
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20111207,repor...
Keywords: Security
Depends On: 766537 766538 766539 766540 766542 833912
Blocks: 765833
TreeView+ depends on / blocked
 
Reported: 2011-12-09 14:08 UTC by Jan Lieskovsky
Modified: 2016-03-04 11:49 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-08-02 05:03:47 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
stashing RHEL-5 backport of equivalent fix (550 bytes, patch)
2011-12-12 09:58 UTC, Caolan McNamara
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1815 normal SHIPPED_LIVE Moderate: icu security update 2011-12-14 03:09:26 UTC

Description Jan Lieskovsky 2011-12-09 14:08:09 UTC
A stack-based buffer overflow flaw was found in the way ICU, the tools and utilities for developing with International Components for Unicode, performed variant canonicalization for the given locale identifier. A remote attacker could provide a specially-crafted locale representation, which once opened by an unsuspecting, local user in an application, linked against ICU library, could lead to crash of that application or possibly execute arbitrary code with the permissions of the user running the application. 

References:
[1] http://bugs.icu-project.org/trac/ticket/8984
    (upstream ticket)
[2] http://crbug.com/106441
    (Google Chrome bug, not public)
[3] http://codereview.chromium.org/8822005/
    (Google Chrome code review entry)
[4] http://codereview.chromium.org/8822005/patch/6001/7002
    (Google Chrome patch)
[5] http://www.openwall.com/lists/oss-security/2011/12/09/2
    (CVE Request)

Comment 2 Vincent Danen 2011-12-09 21:28:06 UTC
This issue was assigned the name CVE-2011-4599:

http://seclists.org/oss-sec/2011/q4/490

Comment 5 Huzaifa S. Sidhpurwala 2011-12-12 09:55:00 UTC
This issue affects the version of icu as shipped with Red Hat Enterprise Linux 5 and 6.

This issue affects the version of icu as shipped with Fedora release 15 and 16.

Comment 6 Caolan McNamara 2011-12-12 09:58:29 UTC
Created attachment 545647 [details]
stashing RHEL-5 backport of equivalent fix

Comment 8 Huzaifa S. Sidhpurwala 2011-12-12 10:04:22 UTC
Created icu tracking bugs for this issue

Affects: fedora-all [bug 766542]

Comment 10 errata-xmlrpc 2011-12-13 22:14:24 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2011:1815 https://rhn.redhat.com/errata/RHSA-2011-1815.html

Comment 12 sarju 2012-08-07 14:21:37 UTC
check this issues is there any test case for this issues?

Comment 13 sarju 2012-08-07 14:23:17 UTC
for this issues is there any test case?

Comment 14 Eike Rathke 2012-08-07 17:15:07 UTC
The only information available is http://bugs.icu-project.org/trac/ticket/8984 and the patch attached there http://bugs.icu-project.org/trac/attachment/ticket/8984/canonicalize2.patch and the code mentioned http://bugs.icu-project.org/trac/browser/icu/trunk/source/common/uloc.cpp#L1808

From the code it looks like one would have to pass an oversized locale string with a variant set (that if stripped either leaves an empty or still oversized string) to the internal _canonicalize() function with a _ULOC_CANONICALIZE option set.

Comment 15 rajasekhar.maddala 2012-08-08 11:26:35 UTC
Is there any existing ICU test sample to verify this fix?


Note You need to log in before you can comment on or make changes to this bug.