oss-security - A small backlog of vulnerabilities in Chicken Scheme

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130202135903.GB16583@frohike.homeunix.org>
Date: Sat, 2 Feb 2013 14:59:03 +0100
From: Peter Bex <Peter.Bex@...all.nl>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: A small backlog of vulnerabilities in Chicken Scheme

Hello all,

Recently a handful of security bugs have been found and fixed in the
Chicken Scheme compiler (http://www.call-cc.org).  We (the core team)
have decided we'd like to start using CVE identifiers for the benefit
of our users and distributions.

I'd like to request CVEs for the currently known security bugs:

* POSIX select() buffer overrun, fixed on in Chicken 4.8.2 (development
snapshot) by switching to POSIX poll() on platforms where supported.
This is also fixed in 4.8.0.1 (stability release).

Original announcement, with workaround (followed by preliminary patch):
http://lists.nongnu.org/archive/html/chicken-users/2012-06/msg00031.html
Final patch:
http://lists.nongnu.org/archive/html/chicken-hackers/2012-11/msg00075.html

* Poisoned NUL byte injection due to incomplete protection by missing
checks in some procedures, fixed in Chicken 4.8.0:
http://lists.nongnu.org/archive/html/chicken-users/2012-09/msg00004.html

* Broken randomization procedure on 64-bit platforms (it returned a
constant value).  This function wasn't used for security purposes
(and is advertised as being unsuitable), so I'm unsure a CVE is needed:
http://lists.nongnu.org/archive/html/chicken-hackers/2012-02/msg00084.html
Fixed in 4.8.0.

* Vulnerability to algorithmic complexity attacks due to hash table
collisions.  Fixed in 4.8.0.
First public confirmation of the issue, with preliminary (broken) patch:
http://lists.nongnu.org/archive/html/chicken-hackers/2012-01/msg00002.html
Proper fix:
http://lists.nongnu.org/archive/html/chicken-hackers/2012-01/msg00020.html

Please let me know if more info is required or if this is even the
proper way to request CVEs.

I'd also like to know if it's possible to get CVE numbers assigned
*before* issuing a security advisory, but without immediate full
disclosure, so an initial advisory can be complete with CVE number.
The CVE can be updated afterwards with the link to the advisory when
it is issued.  This should make it easier for users to find information
about the bug.  This list's Openwall wiki seems to imply that it's
only possible to request a CVE for an issue given all the information
immediately, but a recent message from Kurt Seifried in a thread about
Jenkins says that it can be done.  If it's indeed okay to e-mail Kurt
directly, it would be helpful to include this in the documentation wiki.

Finally, how do CVE entries in MITRE and/or the NVD get updated?
I couldn't find anything about this in the FAQ.  For example, if we
find and fix a noncritical vulnerability but the fix is rather
complicated and needs to be thoroughly tested, the fix might appear
in a release after CVE and advisory are issued.  How will this be
reflected in the information once the version in which the fix appears
is finally known?

Cheers,
Peter Bex (on behalf of the Chicken core team)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.