oss-security - CVE-2013-0288 nss-pam-ldapd: FD_SET array index error, leading to stack-based buffer overflow

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1929565351.4029588.1361208554968.JavaMail.root@redhat.com>
Date: Mon, 18 Feb 2013 12:29:14 -0500 (EST)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Arthur de Jong <arthur@...hurdejong.org>,
        Garth Mollett <garth.mollett@...registry.com.au>,
        Nalin Dahyabhai <nalin@...hat.com>, Jakub Hrozek <jhrozek@...hat.com>
Subject: CVE-2013-0288 nss-pam-ldapd: FD_SET array index error, leading to
 stack-based buffer overflow

Hello Steve, vendors,

  an array index error, leading to stack-based buffer overflow
flaw was found in the way nss-pam-ldapd, a PAM and nsswitch module
which uses directory servers, performed management of file descriptors
when performing file descriptors activity wait. An attacker could use
this flaw to cause processes with a large number of opened file
descriptors, that performed name lookups to crash or, potentially,
execute arbitrary code with the privileges of the user running the process.

Upstream advisory (with patches and further details)
[1] http://arthurdejong.org/nss-pam-ldapd/CVE-2013-0288

References:
[2] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0288

Credit: This issue was found by Garth Mollett.

Red Hat would like to thank Garth Mollett for reporting this
issue, and Arthur de Jong of nss-pam-ldapd upstream for help
with coordination of this advisory.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.