oss-security - Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201211221048.06836.mweckbecker@suse.de>
Date: Thu, 22 Nov 2012 10:48:05 +0100
From: Matthias Weckbecker <mweckbecker@...e.de>
To: oss-security@...ts.openwall.com
Cc: Jan Lieskovsky <jlieskov@...hat.com>,
	"Steven M. Christey" <coley@...us.mitre.org>,
	Attila Bogar <attila.bogar@...guamatics.com>,
	Raphael Geissert <geissert@...ian.org>
Subject: Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names

Hi Jan, Steve, Raphael, Attila, ...,

On Tuesday 20 November 2012 12:57:11 Jan Lieskovsky wrote:
> Hi Steve,
>
> ----- Original Message -----
>
[...]
>
[...]
>
> Previously considered scenario was remote user would trick the local one to
> decrypt provided file (obviously the local user might not check if filename
> isn't too long prior decryption). But after further review looks mcrypt
> doesn't support asymmetric cryptography / keys (which I didn't know in the
> moment of requesting a CVE id), only the symmetric one, which makes this
> scenario impossible / unlikely.
>
> Considering the above, I think you are right and CVE-2012-4527 should be
> probably rejected.
>

And what about CVE-2012-4426 then? The same applies there too, right? Reject?

> Right now I can't think of a case, how this could be possible to (mis)use
> for an attack.
>

A program that runs with higher privileges and executes mcrypt with external
user-controlled input possibly? Maybe a bit far fetched, but not impossible.

[...]

Matthias

-- 
Matthias Weckbecker, Senior Security Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0;  http://suse.com/
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.