Date: Fri, 27 Sep 2013 00:14:29 -0600 From: Kurt Seifried <kseifried@...hat.com> To: Open Source Security <oss-security@...ts.openwall.com> Subject: Re: Buffer overrun vulnerability in CHICKEN Scheme -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 09/26/2013 03:27 PM, Peter Bex wrote: > Hi all, > > I'd like to request a CVE for a recently discovered vulnerability > in CHICKEN Scheme. It affects a very particular, not very common > use of the read-string! procedure. If given a buffer and #f (the > Scheme value for "false") as the buffer's size (which should > trigger automatic size detection but doesn't), it will read beyond > the buffer, until the input port (file, socket, etc) is exhausted. > This may result in the typical potential remote code execution or > denial of service; in CHICKEN, these buffers are initially > allocated on the stack and moved to the heap upon GC. > > In normal usage, users would usually pass in the buffer's size. > This is also the workaround for this bug. > > For the official announcement, see > http://lists.nongnu.org/archive/html/chicken-announce/2013-09/msg00000.html > > The discussion thread's final accepted patch is at > http://lists.nongnu.org/archive/html/chicken-hackers/2013-09/msg00009.html > > which got applied as http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=commit;h=cd1b9775005ebe220ba11265dbf5396142e65f26 > > All versions of CHICKEN prior to 126.96.36.199 and 4.8.3 (not yet > released) are affected. > > Cheers, Peter Bex > Please use CVE-2013-4385 for this issue. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQIcBAEBAgAGBQJSRSJFAAoJEBYNRVNeJnmTp1EP/0zsOAo2k2c4DnwSk7K0XFiU uBz9zeIi+y+o2ejZrts0dkc0AFg05V1nbSnAc9Hq/mFNx8kOP+ZB3H+ExFechRLj PnE+Tl9dD/I8oKR2d8Rn95rY/z2gBZj0GoBla+EkERPwsXnXGwBklJOtjFYa1DFZ wqOg2WD17E3/P5ZdK8LoBMi86ZBwibXhWgdmNcJWGtpKWbdbO0Z7Tj6CYNLQrJMQ Nb9LqnBO5Mh2xq0unb8QegxcUdhTWPz23PciUrcml5tyL3SGrMiaBGWzunKN770B oiSV490xOpGyuoLHOAHuQcBysLYHGZ1wfOExAWvPGmuEJpjnma4KX96SCQW16PLl nfH0PpQso9D9PyATOq87hoQwtvDwR/Ez2ak0reAXyC6+kDEbpilY7r3TOiSRwrBM 1uYVt5pLFfblo6MbzgotdvdOJfAmD3pUkU4OOGT6n60CoQSb5hH0HrY16uiTatmb nQvTJNjdPA+eZ1yp1p8x0n7wVkDWcA2C56OBNVHXby/sNUd38vg3za9xRu+UQ9vJ uKuhX/m5+SkVIXhcwBDc+6kAlV15I4EfDYjBS15PryWyapmFkyimA6APsQmDswCB a3NH1w28+ToJeIeL6bmrahOp+jnepiquJwD3eJLdkPwcLUMEN5P2+M/9cVCYpXbE 8SCqKFuqKxPBAOVnpOvG =tO27 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.