Re: [SECURITY] [DSA 918-1] New osh packages fix privilege escalation

[Jochen Schoenfelder]

Hi!

maybe I'm (or my browser's cache is) wrong, but DSA 918-1 seems to have a bug.


On Fri, 9 Dec 2005 06:55:46 +0100 (CET)
[EMAIL PROTECTED] (Martin Schulze) wrote:

 - --
 Debian Security Advisory DSA 918-1 [EMAIL PROTECTED]
 http://www.debian.org/security/ Martin Schulze
 December 9th, 2005  http://www.debian.org/security/faq
 - --
 
 Package: osh
 Vulnerability  : programming error
 Problem type   : local
 Debian-specific: no
 CVE ID : CVE-2005-3347 CVE-2005-3533
 Debian Bug : 338312

CVE-2005-3347 seems to be wrong and should be corrected with CVE-2005-3346 (see
the bug tracker for this:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338312 )

I didn't check the other number, btw..

thx

Jochen Schönfelder

-- 
Dipl. Inf. Jochen Schoenfelder, DFN-CERT Services GmbH
https://www.dfn-cert.de, +49 (0)40 808077-555 (Hotline) -556 (Fax)
PGP RSA/2048, 2738CA9B, FF C9 82 2B 4C FC FD DF 2A F1 7F 2E 65 AA 88 1D


signature.asc
Description: PGP signature

curl 7.13.2-2sarge4 fixes #342339 for sarge and CVE-2005-4077

[Domenico Andreoli]

hi,

  i prepared curl 7.13.2-2sarge4 which fixes a buffer overflow in URL
parser function (#342339, CVE-2005-4077).

complete description of the breach is available at
http://curl.haxx.se/docs/adv_20051207.html,
http://www.hardened-php.net/advisory_242005.109.html,
http://www.securityfocus.com/archive/1/archive/1/418849/100/0/threaded.

i uploaded it to http://people.debian.org/~cavok/curl/ for your revision.

$ debdiff curl_7.13.2-2sarge3.dsc curl_7.13.2-2sarge4.dsc
diff -u curl-7.13.2/debian/changelog curl-7.13.2/debian/changelog
--- curl-7.13.2/debian/changelog
+++ curl-7.13.2/debian/changelog
@@ -1,3 +1,10 @@
+curl (7.13.2-2sarge4) stable-security; urgency=high
+
+  * Fixed buffer overflow in URL parser function (closes: #342339).
+CVE-2005-4077
+
+ -- Domenico Andreoli [EMAIL PROTECTED]  Wed,  7 Dec 2005 13:21:53 +0100
+
 curl (7.13.2-2sarge3) stable-security; urgency=high
 
   * Fixed user+domain name buffer overflow in the NTLM code
only in patch2:
unchanged:
--- curl-7.13.2.orig/lib/url.c
+++ curl-7.13.2/lib/url.c
@@ -2318,12 +2318,18 @@
   if(urllen  LEAST_PATH_ALLOC)
 urllen=LEAST_PATH_ALLOC;
 
-  conn-pathbuffer=(char *)malloc(urllen);
+  /*
+   * We malloc() the buffers below urllen+2 to make room for to possibilities:
+   * 1 - an extra terminating zero
+   * 2 - an extra slash (in case a syntax like www.host.com?moo is used)
+   */
+
+  conn-pathbuffer=(char *)malloc(urllen+2);
   if(NULL == conn-pathbuffer)
 return CURLE_OUT_OF_MEMORY; /* really bad error */
   conn-path = conn-pathbuffer;
 
-  conn-host.rawalloc=(char *)malloc(urllen);
+  conn-host.rawalloc=(char *)malloc(urllen+2);
   if(NULL == conn-host.rawalloc)
 return CURLE_OUT_OF_MEMORY;
   conn-host.name = conn-host.rawalloc;
$

regards
domenico

-[ Domenico Andreoli, aka cavok
 --[ http://people.debian.org/~cavok/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936  4FEE 0677 9033 A20E BC50


signature.asc
Description: Digital signature