[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHmME9pnjh+EfkhDZu8gYFsVGO8mC-wym2gWu0mOVjTCVmve4g@mail.gmail.com>
Date: Sun, 30 Sep 2012 21:21:02 +0200
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: oss-security <oss-security@...ts.openwall.com>
Cc: cgit@...mli.net, meyering@...hat.com
Subject: cgit: heap buffer overflow
Hey oss-sec,
The original author and maintainer of cgit, Lars Hjemli, has been MIA
for the last several months, and nobody I've talked to seems to know
what's happened. Because I've previously been involved with some cgit
things, I'm maintaining a tree of my own to which folks on the cgit
mailing list are now sending patches. It'd be a bit presumptuous to
call myself the new maintainer, but I am trying to keep the project
alive and healthy until Lars returns from wherever he is.
Jim Meyering from Redhat has written to the cgit mailing list with a
detailed analysis and a two line commit fixing a heap buffer overflow.
At the minimum, it's a denial of service, and in the worst case, it
might lead to to a remote shell. If anyone has any tricks on how to
exploit it successfully, I'd be interested to hear them.
You can read his analysis and look at the commit here [1] and a Redhat
bug report here [2].
If this oss-sec finds it concerning enough, I can tag a
non-Lars-approved release and post links to new tarballs for folks.
But there's a chance that exploitation isn't feasible, as Jim has
written in his report, in which case I'd like to hold off on making
any non-Lars-approved releases for a bit.
Thanks,
Jason
[1] http://git.zx2c4.com/cgit/commit/?id=7757d1b046ecb67b830151d20715c658867df1ec
[2] https://bugzilla.redhat.com/show_bug.cgi?id=820733
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
