[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090506184922.7221eda1@redhat.com>
Date: Wed, 6 May 2009 18:49:22 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: Old cscope buffer overflow
On Wed, 6 May 2009 11:49:14 -0400 (EDT) "Steven M. Christey"
<coley@...us.mitre.org> wrote:
> > If you're preparing cscope updates for CVE-2009-0148 and you may
> > still be shipping packages based on 15.5, you may want to have a
> > look at:
> >
> > https://bugzilla.redhat.com/show_bug.cgi?id=499174
> >
> > Steve, as the first public report for this is from 2006:
> >
> > https://bugzilla.redhat.com/show_bug.cgi?id=189666
> >
> > I believe 2006 CVE id is needed here.
>
> We recently updated CVE-2009-0148 for overflows in cscope before
> 15.7a. Is this the same issue, or do we need a different one?
>
> This seems to be distinct from CVE-2006-4262 as well...
Different from both. CVE-2009-0148 is more of a dupe / re-occurrence /
incomplete fix of even older CVE-2004-2541. Some vendors originally
addressed that via sprintf -> snprintf across whole sources. Upstream
instead preferred to use "%.*s" with bit of length math to avoid
overflow and not harm portability. Though the math could int
underflow, still allowing buffer overflow.
BZ#189666 issue was fixed upstream in 15.6.
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
