Re: [oss-security] libical 0.47 SEGV on unknown address

[Brandon Perry <bperry.volatile () gmail com>]

I have gone ahead and just pushed my fuzzing results to Github. These were found with American Fuzzy Lop.

https://github.com/brandonprry/ical-fuzz <https://github.com/brandonprry/ical-fuzz>

While Mozilla lists information leaks as viable for a bug bounty [1], unless it straight up crashes Thunderbird (which 
heap over reads may or may not do depending on the surrounding memory), it doesn’t seem they will care much and will 
mark your bugs as sec-low which is not valid for the bug bounty.

ASan reports are in the min_crashes folder with .asan extension. Some of the ical files in the raw_queue and 
raw_crashes were generated using the commented out code in the icaltestparser.c file, which will result in some 
use-after-frees as well (some of it in the icaltestparser code actually, but not all).

You actually can’t compile Thunderbird with ASan at the moment, and haven’t been able to for some time as far as I can 
tell. I have spent days trying to make this work to no avail. Without this, there won’t be a clean reproduction to 
crash Thunderbird most likely.

[1] https://www.mozilla.org/en-US/security/client-bug-bounty/ 
<https://www.mozilla.org/en-US/security/client-bug-bounty/> (Security bug must be a remote exploit, the cause of a 
privilege escalation, or an information leak)


> On Jun 25, 2016, at 10:41 AM, Brandon Perry <bperry.volatile () gmail com> wrote:
>
> > On Jun 25, 2016, at 10:34 AM, Alan Coopersmith <alan.coopersmith () oracle com <mailto:alan.coopersmith () oracle 
> > com>> wrote:
> >
> > On 06/24/16 06:54 AM, Brandon Perry wrote:
> > > I am posting this to Full Disclosure/OSS instead of reporting it because I have
> > > opened a handful of libical bugs in the Mozilla bug tracker, alerted
> > > security () mozilla org <mailto:security () mozilla org> <mailto:security () mozilla org <mailto:security () 
> > > mozilla org>>, and worked to show how and
> > > where to reproduce the bugs in Thunderbird, but Mozilla hasn’t shown any care at
> > > all about the bugs. Perhaps if I give a sample to the community of the bugs in
> > > the bug reports, Mozilla will take the bug reports more seriously. This bug
> > > attached had not been reported yet.
> >
> > Did you report them to libcial upstream?  http://libical.github.io/libical/ 
> > <http://libical.github.io/libical/><http://libical.github.io/libical/ <http://libical.github.io/libical/>>
>
> I had initially asked for contact information regarding reporting potentially sensitive security test cases, but 
> after a couple of days, I decided to look into another product that I figured would have more visibility and more 
> power to get things fixed.
>
> https://github.com/libical/libical/issues/235 <https://github.com/libical/libical/issues/235> 
> <https://github.com/libical/libical/issues/235 <https://github.com/libical/libical/issues/235>>
> > > My roommate mentioned Thunderbird being a second-class citizen in the Mozilla
> > > world, so if this is the case, this should be made explicit in regards to bug
> > > bounty expectations.
> >
> > While Thunderbird is still a beloved child of Mozilla, it's been told it's time
> > to move out of its parents house and find its own sources of income/support:
> >
> > https://groups.google.com/d/msg/mozilla.governance/kAyVlhfEcXg/Eqyx1X62BQAJ
> > https://blog.mozilla.org/thunderbird/2015/12/thunderbird-active-daily-inquiries-surpass-10-million/
> >
> > --
> >      -Alan Coopersmith-              alan.coopersmith () oracle com
> >       Oracle Solaris Engineering - http://blogs.oracle.com/alanc
>
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure <https://nmap.org/mailman/listinfo/fulldisclosure>
> Web Archives & RSS: http://seclists.org/fulldisclosure/ <http://seclists.org/fulldisclosure/>

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/