Date: Sun, 30 Sep 2012 21:21:02 +0200 From: "Jason A. Donenfeld" <Jason@...c4.com> To: oss-security <oss-security@...ts.openwall.com> Cc: cgit@...mli.net, meyering@...hat.com Subject: cgit: heap buffer overflow Hey oss-sec, The original author and maintainer of cgit, Lars Hjemli, has been MIA for the last several months, and nobody I've talked to seems to know what's happened. Because I've previously been involved with some cgit things, I'm maintaining a tree of my own to which folks on the cgit mailing list are now sending patches. It'd be a bit presumptuous to call myself the new maintainer, but I am trying to keep the project alive and healthy until Lars returns from wherever he is. Jim Meyering from Redhat has written to the cgit mailing list with a detailed analysis and a two line commit fixing a heap buffer overflow. At the minimum, it's a denial of service, and in the worst case, it might lead to to a remote shell. If anyone has any tricks on how to exploit it successfully, I'd be interested to hear them. You can read his analysis and look at the commit here  and a Redhat bug report here . If this oss-sec finds it concerning enough, I can tag a non-Lars-approved release and post links to new tarballs for folks. But there's a chance that exploitation isn't feasible, as Jim has written in his report, in which case I'd like to hold off on making any non-Lars-approved releases for a bit. Thanks, Jason  http://git.zx2c4.com/cgit/commit/?id=7757d1b046ecb67b830151d20715c658867df1ec  https://bugzilla.redhat.com/show_bug.cgi?id=820733
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ