Bug 523258 (CVE-2008-7224) - CVE-2008-7224 elinks: entity_cache static array buffer overflow (off-by-one)
Summary: CVE-2008-7224 elinks: entity_cache static array buffer overflow (off-by-one)
Alias: CVE-2008-7224
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://bugs.debian.org/cgi-bin/bugrep...
Depends On: 525695 525696 525697 525698 833894
TreeView+ depends on / blocked
Reported: 2009-09-14 15:48 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:32 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2009-10-01 18:16:31 UTC

Attachments (Terms of Use)
Local copy of upstream CVE-2008-7224 patch. (2.36 KB, patch)
2009-09-14 15:55 UTC, Jan Lieskovsky
no flags Details | Diff

System ID Private Priority Status Summary Last Updated
Debian BTS 380347 0 None None None Never
Red Hat Product Errata RHSA-2009:1471 0 normal SHIPPED_LIVE Important: elinks security update 2009-10-01 17:26:23 UTC

Description Jan Lieskovsky 2009-09-14 15:48:37 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7224 to
the following vulnerability:

Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows
remote attackers to cause a denial of service (crash) via a crafted


Upstream patch:
git show 341d54151f69d087112e1514b928e3fcc1810194

Comment 1 Jan Lieskovsky 2009-09-14 15:50:22 UTC
This issue does NOT affect the version of the elinks package, as shipped
with Red Hat Enterprise Linux 3.

This issue affects the versions of the elinks package, as shipped
with Red Hat Enterprise Linux 4 and 5.

Comment 2 Jan Lieskovsky 2009-09-14 15:55:58 UTC
Created attachment 360964 [details]
Local copy of upstream CVE-2008-7224 patch.

Comment 3 Tomas Hoger 2009-09-25 09:46:20 UTC
This bugs cause overflow (off-by-one) of entity_cache array, as last+1 entry was first initialized before array's upper bound was checked.  Out-of-array write can only be triggered by 8-character entities (shorter may also cause writes to unintended places, but all within entity_cache array).

Following structure is written past the array end:

    396 struct entity_cache {
    397 	unsigned int hits;
    398 	int strlen;
    399 	int encoding;
    400 	unsigned char *result;
    401 	unsigned char str[20]; /* Suffice in any case. */
    402 };

Out of the members, attacker may control encoding (possible values are very limited though), first 8 chars of str[] and possibly hits (though elinks may crash before hits gets incremented to a desired value).

As entity_cache is static array, real impact is not easily predictable, as it depends what other static data are placed right behind the array and how those are used.  This may not be as easy to reproduce reliably as stack / heap overflow.  I'm able to get crash on RHEL5/i386 version, but not on RHEL4 version.

Comment 7 errata-xmlrpc 2009-10-01 17:26:27 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:1471 https://rhn.redhat.com/errata/RHSA-2009-1471.html

Note You need to log in before you can comment on or make changes to this bug.