Bug 765812 - (CVE-2011-4599) CVE-2011-4599 icu: Stack-based buffer overflow by canonicalizing the given localeID
CVE-2011-4599 icu: Stack-based buffer overflow by canonicalizing the given lo...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20111207,repor...
: Security
Depends On: 766537 766538 766539 766540 766542 833912
Blocks: 765833
  Show dependency treegraph
 
Reported: 2011-12-09 09:08 EST by Jan Lieskovsky
Modified: 2016-03-04 06:49 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-08-02 01:03:47 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
stashing RHEL-5 backport of equivalent fix (550 bytes, patch)
2011-12-12 04:58 EST, Caolan McNamara
no flags Details | Diff

  None (edit)
Description Jan Lieskovsky 2011-12-09 09:08:09 EST
A stack-based buffer overflow flaw was found in the way ICU, the tools and utilities for developing with International Components for Unicode, performed variant canonicalization for the given locale identifier. A remote attacker could provide a specially-crafted locale representation, which once opened by an unsuspecting, local user in an application, linked against ICU library, could lead to crash of that application or possibly execute arbitrary code with the permissions of the user running the application. 

References:
[1] http://bugs.icu-project.org/trac/ticket/8984
    (upstream ticket)
[2] http://crbug.com/106441
    (Google Chrome bug, not public)
[3] http://codereview.chromium.org/8822005/
    (Google Chrome code review entry)
[4] http://codereview.chromium.org/8822005/patch/6001/7002
    (Google Chrome patch)
[5] http://www.openwall.com/lists/oss-security/2011/12/09/2
    (CVE Request)
Comment 2 Vincent Danen 2011-12-09 16:28:06 EST
This issue was assigned the name CVE-2011-4599:

http://seclists.org/oss-sec/2011/q4/490
Comment 5 Huzaifa S. Sidhpurwala 2011-12-12 04:55:00 EST
This issue affects the version of icu as shipped with Red Hat Enterprise Linux 5 and 6.

This issue affects the version of icu as shipped with Fedora release 15 and 16.
Comment 6 Caolan McNamara 2011-12-12 04:58:29 EST
Created attachment 545647 [details]
stashing RHEL-5 backport of equivalent fix
Comment 8 Huzaifa S. Sidhpurwala 2011-12-12 05:04:22 EST
Created icu tracking bugs for this issue

Affects: fedora-all [bug 766542]
Comment 10 errata-xmlrpc 2011-12-13 17:14:24 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2011:1815 https://rhn.redhat.com/errata/RHSA-2011-1815.html
Comment 12 sarju 2012-08-07 10:21:37 EDT
check this issues is there any test case for this issues?
Comment 13 sarju 2012-08-07 10:23:17 EDT
for this issues is there any test case?
Comment 14 Eike Rathke 2012-08-07 13:15:07 EDT
The only information available is http://bugs.icu-project.org/trac/ticket/8984 and the patch attached there http://bugs.icu-project.org/trac/attachment/ticket/8984/canonicalize2.patch and the code mentioned http://bugs.icu-project.org/trac/browser/icu/trunk/source/common/uloc.cpp#L1808

From the code it looks like one would have to pass an oversized locale string with a variant set (that if stripped either leaves an empty or still oversized string) to the internal _canonicalize() function with a _ULOC_CANONICALIZE option set.
Comment 15 rajasekhar.maddala 2012-08-08 07:26:35 EDT
Is there any existing ICU test sample to verify this fix?

Note You need to log in before you can comment on or make changes to this bug.