Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4025 to the following vulnerability: Name: CVE-2012-4025 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4025 Assigned: 20120716 Reference: http://sourceforge.net/mailarchive/forum.php?thread_name=CAAoG81HL9oP8roPLLhftTSXTzSD%2BZcR66PRkVU%3Df76W3Mjde_w%40mail.gmail.com&forum_name=squashfs-devel Reference: OSVDB:83899 Reference: http://www.osvdb.org/83899 Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
I'll keep an eye out for patches for this. Based on the discussion on the source forge list, I don't think anything is likely to happen soon. Phillip considers the two recent bugs to be relatively minor (I think that assessment is correct), he doesn't have a lot of time right now and the reporter has irked him. There appear to be fixes to check for other kinds of corruption queued up that may also cause similar issues. I have been keeping an eye out for a 4.3 release, as I am not sure what shape Phillip considers the current trunk to be in. If people think this really warrants a relatively rapid response I can look into seeing if I can find or make fixes?
RHEL5 is not affected, as it does not support parallel processing and does not use queues.
Created squashfs-tools tracking bugs for this issue Affects: fedora-all [bug 847270]
Statement: This issue did not affect the versions of squashfs-tools as shipped with Red Hat Enterprise Linux 5 as they did not include support for parallel processing and do not make use of queues.
There is an upstream commit for this. I am looking at backporting it now. http://squashfs.git.sourceforge.net/git/gitweb.cgi?p=squashfs/squashfs;a=commit;h=8515b3d420f502c5c0236b86e2d6d7e3b23c190e
I have updates for rawhide, f16, f17 and f18.
squashfs-tools-4.2-5.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
squashfs-tools-4.2-5.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
squashfs-tools-4.2-5.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
Note that squashfs tools 4.3 is due out in a few weeks and will have fixes for a number of potential issues with handling bad data.
Please don't close SRT bugs; this needs to remain open for RHEL6 where it is deferred.
Should I have closed 847270 now that all of the Fedora instances have fixes?
Yeah, closing the Fedora bug would be good. Thanks.