|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2004-0235: LHA buffer overflows | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Sebastian Krahmer <krahmer> |
| Component: | Incidents | Assignee: | Stanislav Brabec <sbrabec> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | CVE-2004-0235: CVSS v2 Base Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: |
overflow and directory traversal patch
patchinfo patchinfo for box |
||
|
Description
Sebastian Krahmer
2004-04-20 17:53:59 UTC
<!-- SBZ_reproduce --> See bug description CAN-2004-0234 for the buffer overflows (both)
CAN-2004-0235 for the lack of protection against directory
traversal
Can you attach the patch or URL? Note for reporter: I have tried to contact author twice (to get source of 1.17). No reply. No patches yet. I will ask vendor-sec. April 29th seems to be release date. Created attachment 18452 [details]
overflow and directory traversal patch
I did not check whether the patch takes into account
that the size variables etc could be negative (do not have
the LHA sources handy).
I have now patched packages for stable-all sles7 sles7-ppc sles9-all ul1-all 8.0-all 8.2-all 9.0-all. header_size is declared as int and assigned as (header_size = get_word()), so n theory it can not be negative on platforms, where sizeof(int)>sizeof(word). Please confirm and I will submit it. Depends on the Code. it can, due to signed extension:
#include <stdio.h>
short get_word()
{
return 0xffff;
}
int main(int argc, char *argv[])
{
int i = get_word();
printf("%d\n", i);
return 0;
}
I will have a look at the LHA code.
I checked the code. since get-word() returns unsigned word, it is ok. So the patch is ok. Please submit. Fix submitted for: stable-all sles7 sles7-ppc sles9-all ul1-all 8.0-all 8.2-all 9.0-all So where are the patchinfo files? Just a second. I am writing them... Created attachment 18651 [details]
patchinfo
...
Created attachment 18652 [details]
patchinfo for box
...
Patchinfos created and submitted. Please tell suse-dist. Mail to suse-dist was sent. packages tested by qa-team. do we have a coordinated release date, Sebastian. I think April 29th. I asked vendor-sec. Just approved packages. Will be announced with next advisory in section2. CVE-2004-0235: CVSS v2 Base Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N) |