Date: Thu, 22 Nov 2012 11:55:01 +0000 From: Attila Bogár <attila.bogar@...guamatics.com> To: Matthias Weckbecker <mweckbecker@...e.de> Cc: oss-security@...ts.openwall.com, Jan Lieskovsky <jlieskov@...hat.com>, "Steven M. Christey" <coley@...us.mitre.org>, Raphael Geissert <geissert@...ian.org> Subject: Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names Hi, On Thu, 22 Nov 2012 10:48:05 +0100 > > A program that runs with higher privileges and executes mcrypt with external > user-controlled input possibly? Maybe a bit far fetched, but not impossible. The problem I tried to solve, when discovered the overflow was: Alice: - store encrypted parts of the filesystem recursively - keep permissions and ownership informations - bundling can't be used - must support incremental updates and delete - burn into multi session rock ridge DVD /this is not relevant/ Bob: - restores the backup recursively from the DVD Alice and Bob is using "find /dir -type f -exec mcrypt" for encrypt/decrypt as root. What about if the DVD filenames have been tampered during transit... ...or encrypting user data, which can have any filename combinations? Do not run mcrypt as root is not a valid answer, but I know it can be solved in userland. Regards, Attila -- Attila Bogár <attila.bogar@...guamatics.com>
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.