FS#16253 - [glibc] strfmon() integer overflow

Attached to Project: Arch Linux
Opened by Roman Kyrylych (Romashka) - Saturday, 19 September 2009, 07:37 GMT
Last edited by Allan McRae (Allan) - Thursday, 22 October 2009, 10:28 GMT
Task Type Bug Report
Category Security
Status Closed
Assigned To Jan de Groot (JGC)
Andreas Radke (AndyRTR)
Allan McRae (Allan)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
GNU glibc is prone to an integer-overflow weakness.

An attacker can exploit this issue through other applications such as PHP to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition

Additional info:
* glibc x<=2.10.1 affected
* exploit is available
* no fix available yet
* details at http://securityreason.com/achievement_securityalert/67
This task depends upon

Closed by  Allan McRae (Allan)
Thursday, 22 October 2009, 10:28 GMT
Reason for closing:  Fixed
Additional comments about closing:  2.10.1-5 in [testing]
Comment by Allan McRae (Allan) - Saturday, 19 September 2009, 08:47 GMT
Upstream:

http://sources.redhat.com/bugzilla/show_bug.cgi?id=9707 - Closed as invalid
http://sources.redhat.com/bugzilla/show_bug.cgi?id=10600
Comment by Roman Kyrylych (Romashka) - Saturday, 19 September 2009, 14:17 GMT
Yeah, I've seen that closed report. A big ignorance by Ulrich Drepper, and now only NetBSD is not affected by the problem.
"Despite the differences in the code NetBSD libc and glibc, issue is the same but the exploit differs"
Comment by Andreas Radke (AndyRTR) - Monday, 21 September 2009, 20:25 GMT
http://sources.redhat.com/bugzilla/show_bug.cgi?id=10600 - let's where this one will go. It's only vulnerable by a local user. No need to hurry more than the upstream developer(s).
Comment by Allan McRae (Allan) - Thursday, 15 October 2009, 02:07 GMT
Patch: http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=199eb0de8d

I will deal with this when I do the toolchain rebuild for the upcoming binutils release.

Loading...