[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160611075017.GA268@pepper.home.stoeckmann.org>
Date: Sat, 11 Jun 2016 09:50:17 +0200
From: Tobias Stoeckmann <tobias@...eckmann.org>
To: oss-security@...ts.openwall.com
Subject: CVE Request for Denial of Service in pacman 5.0.1
The package manager of Arch Linux, pacman, is vulnerable to a denial of
service attack based on signature files. This issue is located in libalpm
and therefore affects any other frontend of it, too.
A malicious signature file can trigger an out of bondary read on 32 and
64 bit systems, but also leads to an endless loop on 32 bit system.
While an endless loop on itself is no security issue per-se, such a
crafted file might trick the end-user to disable signature verification
to get his updates installed. This, on the other hand, would open up
possibilities for malicious packages to be installed.
Therefore, this DoS can be considered a stepping stone towards a system
attack.
Proof of concept (signature verification must be enabled):
$ uname -m
i686
$ PKG=package-1.0.tar.xz
$ touch $PKG
$ echo "iQEcBAABCAAGBQJXTxJiAAr/////+wA=" | base64 -d - > $PKG.sig
$ sudo pacman -U $PKG
_
The out of boundary access can be used to send 8 bytes inside the
address space of a root-running program to a keyserver, as long as the
byte in front of them is 0x10.
This issue with a patch has been reported upstream. [1]
Can you assign a CVE-ID for this?
--T.
[1] https://lists.archlinux.org/pipermail/pacman-dev/2016-June/021148.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
