oss-security - Re: CVE request: glibc formatted printing vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120711213729.GQ28340@outflux.net>
Date: Wed, 11 Jul 2012 14:37:29 -0700
From: Kees Cook <kees@...ntu.com>
To: Stefan Cornelius <scorneli@...hat.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE request: glibc formatted printing
 vulnerabilities

Hi Stefan,

On Wed, Jul 11, 2012 at 12:32:35PM +0200, Stefan Cornelius wrote:
> 3) It was discovered that the formatted printing functionality in glibc
> did not properly restrict the use of alloca(). A remote attacker could
> provide a specially crafted sequence of format specifiers, leading to a
> crash or, potentially, FORTIFY_SOURCE format string protection mechanism
> bypass, when processed.
> 
> References:
> https://bugzilla.redhat.com/show_bug.cgi?id=826943
> 
> Red Hat patch backports/testcases for RHEL6 that include a patch for this:
> https://bugzilla.redhat.com/attachment.cgi?id=594722&action=diff
> 
> Red Hat patch backport/testcase for RHEL5 (older glibc versions)
> https://bugzilla.redhat.com/attachment.cgi?id=594727&action=diff

Is there an upstream commit proposed for this one? I see it mixed into
the RH patch with fixes for 1) and 2).

Thanks,

-Kees

-- 
Kees Cook

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.