[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20121029205851.GM2676@redhat.com>
Date: Mon, 29 Oct 2012 14:58:51 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: PLIB 1.8.5 ssg/ssgParser.cxx Buffer
Overflow
* [2012-10-29 14:02:58 -0500] Andr?s G?mez Ram?rez wrote:
>Sorry for the previous message, it was not intentional :)
>
>Hi, Could a CVE be assigned to this issue?
>
>Name: PLIB 1.8.5 ssg/ssgParser.cxx Buffer Overflow
>Software: PLIB 1.8.5
>Software link: http://plib.sourceforge.net/
>Vulnerability Type: Stack Based Buffer overflow
>References: http://www.exploit-db.com/exploits/21831/
> http://www.securityfocus.com/bid/55839
>
>Vulnerability Details: Plib is prone to stack based Buffer overflow in the
>error function in ssg/ssgParser.cxx when it loads 3d model files as X
>(Direct x), ASC, ASE, ATG, and OFF, if a very long error message is passed
>to the function, in line 68:
>
>
>// Output an error
>void _ssgParser::error( const char *format, ... )
>{
> char msgbuff[ 255 ];
> va_list argp;
>
> char* msgptr = msgbuff;
> if (linenum)
> {
> msgptr += sprintf ( msgptr,"%s, line %d: ",
> path, linenum );
> }
>
> va_start( argp, format );
>68 vsprintf( msgptr, format, argp );
> va_end( argp );
>
> ulSetError ( UL_WARNING, "%s", msgbuff ) ;
>}
>
>Thanks,
Andreas, was this reported to upstream? I can't see a patch or anything
in their bug tracker regarding this.
--
Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
