[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 11 Aug 2013 09:05:07 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
Florian Weimer <fweimer@...hat.com>
Subject: CVE Request -- glibc: Buffer overwrite when using readdir_r on file
systems returning file names longer than NAME_MAX characters
Hello Kurt, Steve, vendors,
An out-of buffer bounds write flaw was found in the way readdir_r()
routine of glibc, the collection of GNU libc libraries, used to handle
file system entry when its name was longer than NAME_MAX characters
constant, defined by Linux kernel (readdir_r() used to put content of
the directory read into application's allocated buffer, possibly
[NTFS or CIFS filesystems for example] leading to application's
buffer overwrite]. A remote-attacker could provide a specially-crafted
NTFS or CIFS image that, when processed in an application using the
readdir_r() functionality, would lead to that application crash or,
potentially, arbitrary code execution with the privileges of the user
running the application.
This issue was found by Florian Weimer of Red Hat Product Security Team.
Upstream bug report:
[1] http://sourceware.org/bugzilla/show_bug.cgi?id=14699
Latest patch proposal:
[2] http://sourceware.org/ml/libc-alpha/2013-05/msg00445.html
References:
[3] https://bugzilla.redhat.com/show_bug.cgi?id=995839
Can you allocate a CVE id for this?
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
