Re: Re: [CVE Request] glibc iconv_open buffer overflow (was: Re: [oss-security] Re: glibc locale issues)

[John Haxby <john.haxby () oracle com>]

On 13/08/14 07:01, cve-assign () mitre org wrote:
> > > iconv/gconv_charset.h:strip() normalizes the transliteration argument to
> > > iconv_open, so the resulting file names follow a particular pattern, and
> > > there cannot be enough slashes to ascend to a writable directory.
> > >
> > > > if not maybe the one byte overflow is still exploitable.
> > >
> > > Hmm.  How likely is that?  It overflows in to malloc metadata, and the
> > > glibc malloc hardening should catch that these days.
>
> > Not necessarily on 32-bit architectures, so I agree with Tavis now, and
> > we need a CVE.  The upstream bug is:
>
> >    <https://sourceware.org/bugzilla/show_bug.cgi?id=17187>
>
> Use CVE-2014-5119. A CVE-2005-#### number isn't needed because the
> msg00091.html message (referenced in 17187) does not state any
> security implications.

That's correct.  Neither I nor any of the readers of my original bug
report commented on any possible security implications.  (Mind you, in
2005 I was probably a little more naïve.)

jch