oss-security - Silent security fixes in virtuoso-opensource

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 05 May 2015 14:52:33 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Silent security fixes in virtuoso-opensource

virtuoso-opensource is a database used by the KDE desktop search:

  <http://virtuoso.openlinksw.com/dataspace/doc/dav/wiki/Main>

A long time ago, we looked at the low-level data marshaling code in the
database server, and found quite a few memory safety issues.  We also
encountered server crashes and problems which looked like race
conditions, affecting server stability.

KDE uses a private UNIX domain socket to communicate with a
user-specific database server, but the database server can be accessed
over TCP as well.

Upstream did not release a security advisory, but alluded to the fixes
in release announcement:

<http://virtuoso.openlinksw.com/dataspace/doc/dav/wiki/Main/VOSNews#Client%20RPC>

And in commit messages:

<https://github.com/openlink/virtuoso-opensource/commits/develop/6/libsrc/Dk>

We have not assigned CVE identifiers because the number of different
crashes we saw was fairly large, and we could not completely understand
how the RPC implementation is pieced together.

I'm sorry that this message is not particularly helpful.

-- 
Florian Weimer / Red Hat Product Security

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.