oss-sec mailing list archives
Re: CVE request: possible miniupnpc buffer overflow
From: cve-assign () mitre org
Date: Fri, 6 Jun 2014 22:51:07 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
It was pointed out in https://bugzilla.redhat.com/show_bug.cgi?id=1085618 that miniupnpc version 1.9 fixes a possible buffer overflow: https://github.com/miniupnp/miniupnp/commit/3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9
On a related note ... in version 1.9, miniwget.c: 173 n = header_buf_used - endofheaders; 174 memcpy(buf, header_buf + endofheaders, n); Mixing the types together (and the signed int in the memcpy) may warrant further investigation.
From: Murray McAllister <mmcallis () redhat com> Date: Thu, 01 May 2014 10:35:27 +1000 Subject: Re: [oss-security] CVE request: possible miniupnpc buffer overflow
Mixing the types together (and the signed int in the memcpy) may warrant further investigation.
Upstream investigated this and found it to be safe.
Use CVE-2014-3985 for the buffer overflow. In the "investigated this and found it to be safe" sentence, "this" means only the second part of the original message, not the part about the buffer overflow. The while loop in the unpatched code before 3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9 was not found to be safe. (For many people reading the second message, this may have been obvious because the "safe" sentence came after quoted text from only the second part of the original message.) - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTkn2vAAoJEKllVAevmvmsqxoIALD6sDb3SvERks8sXZBRxTs2 CqC4ruw8M6zUXqaeO8U7wCr+2xQn+M+DDFmX9MmxoGVtQd0QPD+gZejXnwSIBj7v yCrBUAwvlU2u2hjPmOxSsXzgSSy+xdsXxiRMK4rqdN1RI5dgzTwHE5t+txwAKR0c Sq3Z0v63rCzb122M/diVfXYos8nCTG+2AwtIOFd1zkbCoHRFdfHdeHjXl1jbYhRU +WKGHudUeNjqAyxg00PDpbz5KRo8zWpEMhQF9o8q5yY1lZyeo0A7iWXweGRb4g0M WANluLwi+12nc24zeViNUN/9rdjO3BCXQ7hYwTQLjQKUEmpfDSInlG1giZac0Tc= =D1eB -----END PGP SIGNATURE-----
Current thread:
- CVE request: possible miniupnpc buffer overflow Murray McAllister (Apr 29)
- Re: CVE request: possible miniupnpc buffer overflow Murray McAllister (Apr 30)
- Re: CVE request: possible miniupnpc buffer overflow Moritz Muehlenhoff (Jun 06)
- Re: CVE request: possible miniupnpc buffer overflow cve-assign (Jun 06)