Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 01 Dec 2014 10:42:21 +0100
From: Martin Prpic <mprpic@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: missing checks for small-sized files in hivex

Ping, can this please get a CVE?


Martin Prpic writes:

> Hello,
>
> Can a CVE please be assigned to the following issue?
>
> It was reported that hivex [1], a library that can read and write hive files (undocumented binary files that Windows uses to store the Windows Registry on disk), did not properly handle small-sized hive files. An attacker able to supply a hive file of a small size to an application using the hivex library could use this flaw to read, and possibly write, up to 4095 bytes beyond the end of the allocated buffer, potentially resulting in arbitrary code execution with the with the privileges of the user running that application.
>
> This issue has been fixed in upstream version 1.3.11 of hivex. Upstream patches are available at:
>
> https://github.com/libguestfs/hivex/commit/357f26fa64fd1d9ccac2331fe174a8ee9c607adb
> https://github.com/libguestfs/hivex/commit/4bbdf555f88baeae0fa804a369a81a83908bd705
>
> References:
>
> [1] https://www.redhat.com/archives/libguestfs/2014-October/msg00235.html
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=1167756
>
> Thanks,
>
> --
> Martin Prpič / Red Hat Product Security

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.