Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 21 Oct 2011 15:29:41 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
CC: Solar Designer <solar@...nwall.com>
Subject: Re: hardlink(1) has buffer overflows, is unsafe on
 changing trees

On 10/20/2011 08:27 PM, Josh Bressers wrote:

>> The hardlink(1) program from Fedora is susceptible to buffer overflows of
>> fixed-size nambuf1 and nambuf2 buffers when run on a tree with deeply
>> nested directories and/or with long directory or file names.  I was able
>> to reproduce the problem (got a segfault) by running the program on a
>> directory containing 20 nested directories with 250-character names.
>>
>
> CVE-2011-3630 hardlink buffer overflows
> https://bugzilla.redhat.com/show_bug.cgi?id=746709
>

FORTIFY_SOURCE should really be able to catch this buffer overflow.
The buffer being overflown here in in BSS, But strcat() is used to 
append to this buffer and __builtin___strcat_chk catches it, resulting 
in the program being terminated.

Nice one though!


-- 
Huzaifa Sidhpurwala / Red Hat Security Response Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.