[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20121122115501.6d632266fe01a30db935717f@linguamatics.com>
Date: Thu, 22 Nov 2012 11:55:01 +0000
From: Attila Bogár <attila.bogar@...guamatics.com>
To: Matthias Weckbecker <mweckbecker@...e.de>
Cc: oss-security@...ts.openwall.com, Jan Lieskovsky <jlieskov@...hat.com>,
"Steven M. Christey" <coley@...us.mitre.org>, Raphael Geissert
<geissert@...ian.org>
Subject: Re: CVE Request -- mcrypt: stack-based buffer
overflow by encryption / decryption of overly long file names
Hi,
On Thu, 22 Nov 2012 10:48:05 +0100
>
> A program that runs with higher privileges and executes mcrypt with external
> user-controlled input possibly? Maybe a bit far fetched, but not impossible.
The problem I tried to solve, when discovered the overflow was:
Alice:
- store encrypted parts of the filesystem recursively
- keep permissions and ownership informations
- bundling can't be used - must support incremental updates and delete
- burn into multi session rock ridge DVD /this is not relevant/
Bob:
- restores the backup recursively from the DVD
Alice and Bob is using "find /dir -type f -exec mcrypt" for encrypt/decrypt as root.
What about if the DVD filenames have been tampered during transit... ...or encrypting user data, which can have any filename combinations?
Do not run mcrypt as root is not a valid answer, but I know it can be solved in userland.
Regards,
Attila
--
Attila Bogár <attila.bogar@...guamatics.com>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
