Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 22 Nov 2012 11:55:01 +0000
From: Attila Bogár <>
To: Matthias Weckbecker <>
Cc:, Jan Lieskovsky <>,
 "Steven M. Christey" <>, Raphael Geissert
Subject: Re: CVE Request -- mcrypt: stack-based buffer
 overflow by encryption / decryption of overly long file names


On Thu, 22 Nov 2012 10:48:05 +0100
> A program that runs with higher privileges and executes mcrypt with external
> user-controlled input possibly? Maybe a bit far fetched, but not impossible.

The problem I tried to solve, when discovered the overflow was:

- store encrypted parts of the filesystem recursively
- keep permissions and ownership informations
- bundling can't be used - must support incremental updates and delete
- burn into multi session rock ridge DVD /this is not relevant/

- restores the backup recursively from the DVD

Alice and Bob is using "find /dir -type f -exec mcrypt" for encrypt/decrypt as root.

What about if the DVD filenames have been tampered during transit... ...or encrypting user data, which can have any filename combinations?

Do not run mcrypt as root is not a valid answer, but I know it can be solved in userland.


Attila Bogár <>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.