oss-security - libical 0.47 SEGV on unknown address

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 24 Jun 2016 08:54:08 -0500
From: Brandon Perry <bperry.volatile@...il.com>
To: fulldisclosure@...lists.org,
 oss-security@...ts.openwall.com
Subject: libical 0.47 SEGV on unknown address

Hello lists

Attached is a test case for causing a crash in libical 0.47 (shipped with Thunderbird) and this was also tested against 1.0 (various versions shipped with various email clients).

=================================================================
==24662==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x0000004fbb80 bp 0x7ffd68d966f0 sp 0x7ffd68d96520 T0)
    #0 0x4fbb7f in icalproperty_new_clone (/root/tmp/new_parse/parse_string047_asan+0x4fbb7f)
    #1 0x4f44e6 in icalparser_add_line (/root/tmp/new_parse/parse_string047_asan+0x4f44e6)
    #2 0x4efabe in icalparser_parse (/root/tmp/new_parse/parse_string047_asan+0x4efabe)
    #3 0x4f9c1f in icalparser_parse_string (/root/tmp/new_parse/parse_string047_asan+0x4f9c1f)
    #4 0x4eb7ef in main (/root/tmp/new_parse/parse_string047_asan+0x4eb7ef)
    #5 0x7fb657683a3f in __libc_start_main /build/glibc-ryFjv0/glibc-2.21/csu/libc-start.c:289
    #6 0x444ae8 in _start (/root/tmp/new_parse/parse_string047_asan+0x444ae8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 icalproperty_new_clone
==24662==ABORTING

I am posting this to Full Disclosure/OSS instead of reporting it because I have opened a handful of libical bugs in the Mozilla bug tracker, alerted security@...illa.org <mailto:security@...illa.org>, and worked to show how and where to reproduce the bugs in Thunderbird, but Mozilla hasn’t shown any care at all about the bugs. Perhaps if I give a sample to the community of the bugs in the bug reports, Mozilla will take the bug reports more seriously. This bug attached had not been reported yet.

While list members likely will not have access to these bugs, I am listing them here in case someone on the list can make something happen.

https://bugzilla.mozilla.org/show_bug.cgi?id=1275400 <https://bugzilla.mozilla.org/show_bug.cgi?id=1275400> (Opened a month ago. After Tyson reproed the bug in libical, no responses).

The following three bugs are distinct heap over-reads in libical (tested against libical 0.47 and 1.0) which have had little to no reception by Mozilla.

https://bugzilla.mozilla.org/show_bug.cgi?id=1280832 <https://bugzilla.mozilla.org/show_bug.cgi?id=1280832>
https://bugzilla.mozilla.org/show_bug.cgi?id=1281041 <https://bugzilla.mozilla.org/show_bug.cgi?id=1281041>
https://bugzilla.mozilla.org/show_bug.cgi?id=1281043 <https://bugzilla.mozilla.org/show_bug.cgi?id=1281043>

My roommate mentioned Thunderbird being a second-class citizen in the Mozilla world, so if this is the case, this should be made explicit in regards to bug bounty expectations.

Content of type "text/html" skipped

Download attachment "segv.ics.bug" of type "application/octet-stream" (8183 bytes)

Content of type "text/html" skipped

Download attachment "signature.asc" of type "application/pgp-signature" (843 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.