Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 20 Oct 2011 10:57:29 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: hardlink(1) has buffer overflows, is unsafe on changing trees



----- Original Message -----
> Hi,
> 
> The hardlink(1) program from Fedora is susceptible to buffer overflows of
> fixed-size nambuf1 and nambuf2 buffers when run on a tree with deeply
> nested directories and/or with long directory or file names.  I was able
> to reproduce the problem (got a segfault) by running the program on a
> directory containing 20 nested directories with 250-character names.
> 
> Another problem is that the program uses full pathnames.  It neither
> changes the current directory, nor uses openat(2).  Thus, if a pathname
> component is replaced with a symlink while the program is running, this
> may result in processing of directories/files outside of the intended
> directory tree.
> 
> I fixed the buffer overflows (by (re)allocating the buffers dynamically)
> in the copy that I committed into Owl today:
> 
> http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/hardlink/
> 

Based on the above commits, I'm giving this three IDs.

CVE-2011-3630 hardlink buffer overflows
https://bugzilla.redhat.com/show_bug.cgi?id=746709

CVE-2011-3631 hardlink integer overflows
https://bugzilla.redhat.com/show_bug.cgi?id=746710

CVE-2011-3632 hardlink symlink attacks
https://bugzilla.redhat.com/show_bug.cgi?id=746713

The Red Hat bugs have more details and links.

Thanks.

-- 
    JB

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.