Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 4 Dec 2014 13:30:33 -0500 (EST)
From: cve-assign@...re.org
To: oss-security@...ts.openwall.com
cc: cve-assign@...re.org
Subject: Re: CVE request: missing checks for small-sized files
 in hivex


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> It was reported that hivex [1], a library that can read and write
> hive files (undocumented binary files that Windows uses to store the
> Windows Registry on disk), did not properly handle small-sized hive
> files. An attacker able to supply a hive file of a small size to an
> application using the hivex library could use this flaw to read, and
> possibly write, up to 4095 bytes beyond the end of the allocated
> buffer, potentially resulting in arbitrary code execution with the
> with the privileges of the user running that application.

Use CVE-2014-9273.

- ---

CVE assignment team, MITRE CVE Numbering Authority M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEVAwUBVICnuallVAevmvmsAQJmtQgAvdc858QDSe7VoTfgyMo/qZa/9sVMs0UF
aKFwc+aZfVrRQDX71kGudujqZE2V/CorB6R0NUYQ6icC9ho41wlEp9tuMLcsnwB1
wslzcbRZht16Zg0wWmQnhyY9ZFrPfYLW2gBrWf3wERrpDbLGleS43/B0O87qI35m
rr7EUSSbkr/P81PcvsVe8mqblpkm9jK0IDUuB8SC141btnCOTL1Wgn/H1/kVgGSZ
QOjk/E2OPF3olNo23yWpADi7U4GW3KLypJ08vpCwR/hsvD2vJ0oSTFpLm/K515Lb
tD3D53+boUNlOLN7rnIWYoCMNu72iwLPRh6vJO9WklSx0W1hCl6MKw==
=+uEe
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.