oss-security - CVE request - mcrypt buffer overflow flaw

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120906143714.GG1356@redhat.com>
Date: Thu, 6 Sep 2012 08:37:14 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request - mcrypt buffer overflow flaw

I don't believe a CVE has been assigned to this, could one be?

A buffer overflow was reported [1],[2] in mcrypt version 2.6.8 and
earlier due to a boundary error in the processing of an encrypted file
(via the check_file_head() function in src/extra.c).  If a user were
tricked into attempting to decrypt a specially-crafted .nc encrypted
flie, this flaw would cause a stack-based buffer overflow that could
potentially lead to arbitrary code execution.

References:

https://bugzilla.redhat.com/show_bug.cgi?id=855029
https://secunia.com/advisories/50507/
https://bugs.gentoo.org/show_bug.cgi?id=434112
http://packetstormsecurity.org/files/116268/mcrypt-2.6.8-Buffer-Overflow-Proof-Of-Concept.html

-- 
Vincent Danen / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.