oss-sec mailing list archives
Re: Full disclosure: denial of service in srvx
From: cve-assign () mitre org
Date: Fri, 29 Aug 2014 21:27:13 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Putting an extremely high value to these parameters, such as 184467440723049 will lead to an integer overflow. When attempting to queue the function execution, srvx will add it in the past, will attempt to execute it immediately and thus will loop forever on this, and will finally crash due to memory exhaustion.
Use CVE-2014-5508 for the integer overflow.
most generic fix. It is here to deny any function adding in the past.
(As far as we could tell from your discussion, there is no way for an attacker to specify a negative number directly. That situation would require a separate CVE ID. In other words, the patch to timeq.c apparently detects a condition that's possible only after an integer overflow occurs.) - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJUASdPAAoJEKllVAevmvms/A8H/3123WncqL1ImFXko4/AVfMW zbhQDGo4NGwVeBNLUPl6G+u/nnFcVtRwQaqG3vKWM6ZgsXUjhSSWhlfPtE6vEvPo QA6Vz/SUd8zs91iNtERyAsWaTcSHR4nVTJ4dBW7hfQWEtI2T3COL8jpcwdsfRHmq hLDXoY7Ixn3P/494exKKJ276fLv+vG9cqdPk+Tx668c31lkcInv5MNr963v+3JQd UHFXhGnSh7tPH1O5ro5KK5fJa632EwHidc/Ozyksi5QrVasn1D6xByToMkxRUU+s cIlPBQVdFeHHc3LONZtxgF/851DCcxigmLlWqmE7xFP5ouut5Jk4YYrQJ92WtFk= =Gxld -----END PGP SIGNATURE-----
Current thread:
- Full disclosure: denial of service in srvx Pierre Schweitzer (Aug 28)
- Re: Full disclosure: denial of service in srvx cve-assign (Aug 29)
- Re: Full disclosure: denial of service in srvx Pierre Schweitzer (Sep 22)
- Re: Full disclosure: denial of service in srvx cve-assign (Aug 29)