oss-security - Re: CVE Request -- Abcm2ps v5.9.12 -- multiple unspecified vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4BBDB63D.1000807@wikimedia.org>
Date: Thu, 08 Apr 2010 20:55:57 +1000
From: Tim Starling <tstarling@...imedia.org>
To: Jan Lieskovsky <jlieskov@...hat.com>
CC: oss-security@...ts.openwall.com, Jean-François Moine <moinejf@...e.fr>, 
 "Steven M. Christey" <coley@...us.mitre.org>,
 Gerard Milmeister <gemi@...ewin.ch>
Subject: Re: CVE Request -- Abcm2ps v5.9.12 -- multiple unspecified
 vulnerabilities

I found:
* A BSS overflow from an overlong command-line parameter (-O)
* BSS overflows in a collection of output macros (PUT0, PUT1, etc.)
exploitable using crafted input files
* A stack overflow in trim_title(), also exploitable using input files

This is assuming my understanding of the linux memory model is correct
and uninitialised global variables are stored in the BSS segment. They
were all the classic sort of overflow, with arbitrary-length strings
copied into fixed-sized buffers.

Anyway, "multiple buffer overflow vulnerabilities" is probably a good
enough summary for most of you.

I haven't reviewed the patch.

-- Tim Starling

Jan Lieskovsky wrote:
> Resending the query again (as first time used improper address
> for Jean-François Moine :().
>
> Apologize other parties for unwanted spam.
>
> Jan.
> -- 
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
>
> Jan Lieskovsky wrote:
>> Hi Steve, vendors,
>>
>>   Abcm2ps upstream has released:
>>     [1] http://moinejf.free.fr/
>>     [2] http://moinejf.free.fr/abcm2ps-5.9.12.tar.gz
>>
>>   latest v5.9.12 version, addressing
>>   "some security vulnerabilities"
>>     [3] http://moinejf.free.fr/abcm2ps-5.txt
>>
>>   References:
>>     [4] http://secunia.com/advisories/39345/
>>
>>   Jean, Tim, could you please provide further details how many
>> and what kind of flaws (i.e. describe each of the deficiencies shortly)
>> has been addressed in this Abcm2ps release? (so we know, how
>> many CVE identifiers:
>>   [5] http://cve.mitre.org/
>>
>> and each of them for what, should be assigned [without comparing
>> source code differences among Abcm2ps v5.9.12 and Abcm2ps v5.9.11
>> versions, potentially resulting in situation, we omit something] )
>>
>> Jean, Tim -- thanks in advance for your cooperation.
>>
>> Regards, Jan.
>> -- 
>> Jan iankko Lieskovsky / Red Hat Security Response Team
>>
>>
>>
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.