[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.64.1412041329560.1687@beijing.mitre.org>
Date: Thu, 4 Dec 2014 13:30:33 -0500 (EST)
From: cve-assign@...re.org
To: oss-security@...ts.openwall.com
cc: cve-assign@...re.org
Subject: Re: CVE request: missing checks for small-sized files
in hivex
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> It was reported that hivex [1], a library that can read and write
> hive files (undocumented binary files that Windows uses to store the
> Windows Registry on disk), did not properly handle small-sized hive
> files. An attacker able to supply a hive file of a small size to an
> application using the hivex library could use this flaw to read, and
> possibly write, up to 4095 bytes beyond the end of the allocated
> buffer, potentially resulting in arbitrary code execution with the
> with the privileges of the user running that application.
Use CVE-2014-9273.
- ---
CVE assignment team, MITRE CVE Numbering Authority M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEVAwUBVICnuallVAevmvmsAQJmtQgAvdc858QDSe7VoTfgyMo/qZa/9sVMs0UF
aKFwc+aZfVrRQDX71kGudujqZE2V/CorB6R0NUYQ6icC9ho41wlEp9tuMLcsnwB1
wslzcbRZht16Zg0wWmQnhyY9ZFrPfYLW2gBrWf3wERrpDbLGleS43/B0O87qI35m
rr7EUSSbkr/P81PcvsVe8mqblpkm9jK0IDUuB8SC141btnCOTL1Wgn/H1/kVgGSZ
QOjk/E2OPF3olNo23yWpADi7U4GW3KLypJ08vpCwR/hsvD2vJ0oSTFpLm/K515Lb
tD3D53+boUNlOLN7rnIWYoCMNu72iwLPRh6vJO9WklSx0W1hCl6MKw==
=+uEe
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
