Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names

[Matthias Weckbecker <mweckbecker () suse de>]

Hi Jan, Steve, Raphael, Attila, ...,

On Tuesday 20 November 2012 12:57:11 Jan Lieskovsky wrote:
> Hi Steve,
>
> ----- Original Message -----
[...]
>
[...]
> Previously considered scenario was remote user would trick the local one to
> decrypt provided file (obviously the local user might not check if filename
> isn't too long prior decryption). But after further review looks mcrypt
> doesn't support asymmetric cryptography / keys (which I didn't know in the
> moment of requesting a CVE id), only the symmetric one, which makes this
> scenario impossible / unlikely.
>
> Considering the above, I think you are right and CVE-2012-4527 should be
> probably rejected.

And what about CVE-2012-4426 then? The same applies there too, right? Reject?

> Right now I can't think of a case, how this could be possible to (mis)use
> for an attack.

A program that runs with higher privileges and executes mcrypt with external
user-controlled input possibly? Maybe a bit far fetched, but not impossible.

[...]

Matthias

-- 
Matthias Weckbecker, Senior Security Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0;  http://suse.com/
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg)