Bug 891577 (CVE-2012-6089, CVE-2012-6090) - CVE-2012-6089 CVE-2012-6090 pl: buffer overflows in path canonisation and expansion of file names with long paths
Summary: CVE-2012-6089 CVE-2012-6090 pl: buffer overflows in path canonisation and exp...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2012-6089, CVE-2012-6090
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: https://lists.iai.uni-bonn.de/piperma...
Whiteboard: impact=low,public=20121221,reported=2...
Depends On: 891666
Blocks: 891671
TreeView+ depends on / blocked
 
Reported: 2013-01-03 10:29 UTC by Petr Pisar
Modified: 2019-06-08 19:21 UTC (History)
5 users (show)

Fixed In Version: SWI-Prolog 6.3.7, SWI-Prolog 6.2.5
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-23 08:36:11 UTC


Attachments (Terms of Use)
Upstream fix for CVE-2012-6089 (2.47 KB, patch)
2013-01-04 11:32 UTC, Petr Pisar
no flags Details | Diff
Upstream fix for CVE-2012-6090 (3.55 KB, patch)
2013-01-04 11:33 UTC, Petr Pisar
no flags Details | Diff
5.10.2 fix for CVE-2012-6089 (2.68 KB, patch)
2013-01-04 13:01 UTC, Petr Pisar
no flags Details | Diff
5.10.2 fix for CVE-2012-6090 (3.77 KB, patch)
2013-01-04 13:01 UTC, Petr Pisar
no flags Details | Diff

Description Petr Pisar 2013-01-03 10:29:54 UTC
Changelog for pl-6.2.5 reads:

 * FIXED: Possible buffer overrun in patch canonisation code.  Pushes
    pointers on an automatic array without checking for overflow.  Can be
    used for DoS attacks.  Will be extremely hard to make it execute
    arbitrary code.

  * SECURITY: Possible buffer overflows when expanding file-names with long
    paths.  Affects expand_file_name/2.  Can lead to crashes (DoS attacks)
    and possibly execution of arbitrary code if an attacker can control
    the names of the files searched for, e.g., if expand_file_name/2 is
    used in a directory to which an attacker can upload files for which
    he can control the name.

These fixes are implemented by upstream commits:


From a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c Mon Sep 17 00:00:00 2001
From: Jan Wielemaker <J.Wielemaker@cs.vu.nl>
Date: Sun, 16 Dec 2012 18:13:17 +0100
Subject: [PATCH] FIXED: Possible buffer overrun in patch canonisation code.

Pushes pointers on an automatic array without checking for overflow.
Can be used for DoS attacks.  Will be extremely hard to make it execute
arbitrary code.


From b2c88972e7515ada025e97e7d3ce3e34f81cf33e Mon Sep 17 00:00:00 2001
From: Jan Wielemaker <J.Wielemaker@cs.vu.nl>
Date: Sun, 16 Dec 2012 17:29:37 +0100
Subject: [PATCH] SECURITY: Possible buffer overflows when expanding
 file-names with long paths.  Affects expand_file_name/2.

Can lead to crashes (DoS attacks) and possibly execution of arbitrary
code if an attacker can control the names of the files searched for,
e.g., if expand_file_name/2 is used in a directory to which an attacker
can upload files for which he can control the name.


I believe the vulnerabilities exist in older pl.

Comment 1 Jan Lieskovsky 2013-01-03 15:20:08 UTC
These issues affect the version of the pl package, as shipped with Red Hat Enterprise Linux 6.

--

These issues affect the versions of the pl package, as shipped with Fedora release of 16 and 17. Please schedule an update.

Comment 2 Jan Lieskovsky 2013-01-03 15:20:57 UTC
Created pl tracking bugs for this issue

Affects: fedora-all [bug 891666]

Comment 3 Jan Lieskovsky 2013-01-03 15:40:16 UTC
CVE request:
  http://www.openwall.com/lists/oss-security/2013/01/03/3

Comment 4 Jan Lieskovsky 2013-01-04 11:14:55 UTC
Based on:
  http://www.openwall.com/lists/oss-security/2013/01/03/7

1) the CVE-2012-6089 identifier has been assigned to the "pl: Possible buffer overrun in patch canonisation code." issue and,
2) the CVE-2012-6090 identifier has been assigned to the "pl: Possible buffer overflows when expanding file-names with long paths" issue.

Comment 5 Petr Pisar 2013-01-04 11:32:21 UTC
Created attachment 672370 [details]
Upstream fix for CVE-2012-6089

Comment 6 Petr Pisar 2013-01-04 11:33:02 UTC
Created attachment 672371 [details]
Upstream fix for CVE-2012-6090

Comment 7 Petr Pisar 2013-01-04 13:01:09 UTC
Created attachment 672401 [details]
5.10.2 fix for CVE-2012-6089

Comment 8 Petr Pisar 2013-01-04 13:01:48 UTC
Created attachment 672402 [details]
5.10.2 fix for CVE-2012-6090

Comment 9 Fedora Update System 2013-01-15 02:23:58 UTC
pl-5.10.2-9.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2013-01-15 02:36:06 UTC
pl-6.0.2-4.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2013-01-15 02:37:38 UTC
pl-6.0.2-5.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Tomas Hoger 2014-06-23 08:36:11 UTC
The pl packages in Red Hat Enterprise Linux 6 are only provided via Optional repository with limited support.  They are provided as dependency for the ppl-swiprolog prolog binding sub-package of the ppl (The Parma Polyhedra Library: a library of numerical abstractions) library, which is also only available via Optional.  These issues will not be fixed in Red Hat Enterprise Linux 6.

Statement:

The Red Hat Security Response Team has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.