oss-security - Re: CVE Request -- glibc: strcoll() integer overflow leading to buffer overflow + another alloca() stack overflow issue (upstream #14547 && #14552)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5052160B.2090002@redhat.com>
Date: Thu, 13 Sep 2012 11:21:15 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Jan Lieskovsky <jlieskov@...hat.com>
CC: oss-security@...ts.openwall.com,
        "Steven M. Christey" <coley@...us.mitre.org>,
        Jeff Law <law@...hat.com>, Jakub Jelinek <jakub@...hat.com>
Subject: Re: CVE Request -- glibc: strcoll() integer overflow
 leading to buffer overflow + another alloca() stack overflow issue (upstream
 #14547 && #14552)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/10/2012 11:51 AM, Jan Lieskovsky wrote:
> Hi Florian,
> 
> thank you for the clarification.
> 
>> On 09/07/2012 07:21 PM, Kurt Seifried wrote:
>> 
>>> 2) Issue #2 (mentioned here only for completeness, but I am not
>>> of the opinion this should receive a CVE identifier. See
>>> argumentation below [but open to glibc upstream / others to
>>> disprove it]).
>> 
>> I will hold off on issuing a CVE for this then. Anyone want to
>> weigh in?
>> 
>> It looks as if the alloca issue was introduced at the same time
>> as the malloc-related overflow:
>> 
>> http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5358d026c74
>>
>>
>> 
So perhaps one CVE is enough for glibc bugs 14552 and 14547 because the
>> problems are similar and affect the same versions.
> 
> Should the alloca() issue get CVE identifier, then I would rather
> use two CVE identifiers. Though those issues might affect same
> glibc versions, one is integer overflow, leading to heap-based
> buffer overflow, while the alloca() one would be stack-based buffer
> overflow.
> 
> So to clearly identify, it would be better if the second one would
> be allocated too (if Steve won't mind).
> 
> Kurt, could you allocate yet one then?

Please use CVE-2012-4424 for this issue.

Also the original report:
http://sourceware.org/bugzilla/show_bug.cgi?id=14552#c0


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQIcBAEBAgAGBQJQUhYLAAoJEBYNRVNeJnmTEQ4QANxQwR1plKLDC2HkgSi4dmMc
JvQ6upCz9q2erXoWM/Y9AXqJnwmlNyMe5aZjV4FCwV6ezaubXAxwbtbGYUMrmWe1
T0Ee6QrLZeXHRn998jb6iBoKP/F5/x9wDHaxy0XciOjacIE8Zq1+V+pcHkBK6YsG
hEu+r2hLALV0HUNXofHTiNu2W36aSH2elhiS2c8SFzqdBxustlMvwqnWeXhi/W+S
0ozaI7sxkIulTlBdOdTKo9+5OB+gcUCrYhMdBTnjgHc2ixpFBo3nykIvuawJKFIj
4fZuIsFm7FsQRC+cPwjES6EuoSJyvNREqO3M90Iwj1nxFAFkKCnQ1p4w4295y7rG
UKx7J4M0S8F5SICJ5YOmq59Ze7V0UeeDAzUejR2Tfhqbo2uBb2c1tZ2MbhnvVw2A
itXh7LpAL5Y3LfxdCwnSFiy/DoGwJx7LnS7SiDHb+4fNjrJAUL3nl3IAm85myM0/
XqGrVJtL5dun26UYX4Yv0ketXQ9Ahccs/bPCfD+2z/LXtz19vjfB5wl2oPb8f4uf
6TlZ4xQOB61MsXIrbSBqPEjcch5IX6ejWcoXetO65P1q4UCktbrPMwuBXot7HLhN
pgK8IHhkxLb/3tMvGen09soL7qERdt1IZK953DiMCLxYrnF6P0QMEq5LmZjCAMcm
yTkAY7yb+CxnYl5/eDmd
=ed8K
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.