oss-sec mailing list archives
CVE Request -- glibc: Buffer overwrite when using readdir_r on file systems returning file names longer than NAME_MAX characters
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Sun, 11 Aug 2013 09:05:07 -0400 (EDT)
Hello Kurt, Steve, vendors, An out-of buffer bounds write flaw was found in the way readdir_r() routine of glibc, the collection of GNU libc libraries, used to handle file system entry when its name was longer than NAME_MAX characters constant, defined by Linux kernel (readdir_r() used to put content of the directory read into application's allocated buffer, possibly [NTFS or CIFS filesystems for example] leading to application's buffer overwrite]. A remote-attacker could provide a specially-crafted NTFS or CIFS image that, when processed in an application using the readdir_r() functionality, would lead to that application crash or, potentially, arbitrary code execution with the privileges of the user running the application. This issue was found by Florian Weimer of Red Hat Product Security Team. Upstream bug report: [1] http://sourceware.org/bugzilla/show_bug.cgi?id=14699 Latest patch proposal: [2] http://sourceware.org/ml/libc-alpha/2013-05/msg00445.html References: [3] https://bugzilla.redhat.com/show_bug.cgi?id=995839 Can you allocate a CVE id for this? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE Request -- glibc: Buffer overwrite when using readdir_r on file systems returning file names longer than NAME_MAX characters Jan Lieskovsky (Aug 11)
- Re: CVE Request -- glibc: Buffer overwrite when using readdir_r on file systems returning file names longer than NAME_MAX characters Florian Weimer (Aug 11)
- Re: CVE Request -- glibc: Buffer overwrite when using readdir_r on file systems returning file names longer than NAME_MAX characters Kurt Seifried (Aug 12)