Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 21 Nov 2010 18:04:10 -0700
From: Kurt Seifried <kurt@...fried.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: gif2png: command-line buffer overflow problem

> How could this possibly be exploited?  If you can trick a user into
> running gif2png [exploit payload], then that user has already lost.

It was reported that some CGI scripts/etc use it automatically so by
using a long file name it may be possible.

Personally I'm not worried but Debian/Fedora have fixed it as a
security issue so if that is the case a CVE would be nice for tracking
purposes.

> See also:
> make `perl -e 'print "A"x10000'`
>
> -Dan


-- 
Kurt Seifried
kurt@...fried.org
tel: 1-703-879-3176

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.