Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue,  2 Jun 2015 22:35:02 -0400 (EDT)
From: cve-assign@...re.org
To: hanno@...eck.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Stack out of bounds read access in uudecode / sharutils

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> https://blog.fuzzing-project.org/13-Stack-out-of-bounds-read-access-in-uudecode-sharutils.html

What are the realistic scenarios in which this has a security impact?

For example, can any of these occur on actual systems?

1. The attacker e-mails a uuencoded file to their own mailbox on a
web-based mail service. This service has a feature in which decoded
data is presented to the recipient. (The server operates on the data
with the uudecode program, not with any other implementation of the
uudecode algorithm. The attacker gains read access to unintended parts
of the server's memory.)

2. A web site allows users to do HTTP uploads of data in uuencoded
format, and supports requests for decoded versions of the data. Same
parenthesized description as above.

3. The attacker composes a news article with crafted uuencoded data
and posts it to the alt.sources Usenet newsgroup. The attacker is
subscribed to this newsgroup in their own account on a web-based
Usenet news reading service. Same parenthesized description as above.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJVbmbWAAoJEKllVAevmvms0BQIAIEpR/65912H2dyOkptzXc3a
yvCUShXy4vInB4X4Y7qdRqNDnEw1omG6gzEauNU545Tnxd3iy0Mx1QmzCHQZIHCl
OH6Y26y+daHICe70uxSzbjXmnGQeeT6JOTV4kPlEuU/GNcRbVsq0CxH2hlIXmweo
D7YYUEH4tcGQQfJrh/sG4w/PiujlimQBynRONJyGOz5yVA5LTp1yl6Vw1hz6GpoS
BazzQP/d+O5thgL0pXkenkwRGbbKP1N2vT9SNCCB04nTM1djY6DQ+2OenaEHSidq
NyKSkxLYNUmP170gXMZvJwS0ruaXpKz4GUYFFwd+Tk1Cy92jyOFyW9IYOv3TF1E=
=xMZZ
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ