Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7224 to the following vulnerability: Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows remote attackers to cause a denial of service (crash) via a crafted link. References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7224 http://linuxfromscratch.org/pipermail/elinks-users/2008-February/001604.html http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=380347 http://osvdb.org/41949 Upstream patch: --------------- git show 341d54151f69d087112e1514b928e3fcc1810194
This issue does NOT affect the version of the elinks package, as shipped with Red Hat Enterprise Linux 3. This issue affects the versions of the elinks package, as shipped with Red Hat Enterprise Linux 4 and 5.
Created attachment 360964 [details] Local copy of upstream CVE-2008-7224 patch.
This bugs cause overflow (off-by-one) of entity_cache array, as last+1 entry was first initialized before array's upper bound was checked. Out-of-array write can only be triggered by 8-character entities (shorter may also cause writes to unintended places, but all within entity_cache array). Following structure is written past the array end: 396 struct entity_cache { 397 unsigned int hits; 398 int strlen; 399 int encoding; 400 unsigned char *result; 401 unsigned char str[20]; /* Suffice in any case. */ 402 }; Out of the members, attacker may control encoding (possible values are very limited though), first 8 chars of str[] and possibly hits (though elinks may crash before hits gets incremented to a desired value). As entity_cache is static array, real impact is not easily predictable, as it depends what other static data are placed right behind the array and how those are used. This may not be as easy to reproduce reliably as stack / heap overflow. I'm able to get crash on RHEL5/i386 version, but not on RHEL4 version.
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2009:1471 https://rhn.redhat.com/errata/RHSA-2009-1471.html