oss-sec mailing list archives
Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names
From: Matthias Weckbecker <mweckbecker () suse de>
Date: Thu, 22 Nov 2012 10:48:05 +0100
Hi Jan, Steve, Raphael, Attila, ..., On Tuesday 20 November 2012 12:57:11 Jan Lieskovsky wrote:
Hi Steve, ----- Original Message -----
[...]
[...]
Previously considered scenario was remote user would trick the local one to decrypt provided file (obviously the local user might not check if filename isn't too long prior decryption). But after further review looks mcrypt doesn't support asymmetric cryptography / keys (which I didn't know in the moment of requesting a CVE id), only the symmetric one, which makes this scenario impossible / unlikely. Considering the above, I think you are right and CVE-2012-4527 should be probably rejected.
And what about CVE-2012-4426 then? The same applies there too, right? Reject?
Right now I can't think of a case, how this could be possible to (mis)use for an attack.
A program that runs with higher privileges and executes mcrypt with external user-controlled input possibly? Maybe a bit far fetched, but not impossible. [...] Matthias -- Matthias Weckbecker, Senior Security Engineer, SUSE Security Team SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany Tel: +49-911-74053-0; http://suse.com/ SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg)
Current thread:
- CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names Jan Lieskovsky (Oct 18)
- Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names Kurt Seifried (Oct 18)
- Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names Steven M. Christey (Nov 19)
- Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names Jan Lieskovsky (Nov 20)
- Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names Matthias Weckbecker (Nov 22)
- Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names Attila Bogár (Nov 22)
- Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names Steven M. Christey (Nov 19)
- Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names Kurt Seifried (Oct 18)