bugfindutils - Bugs: bug #20014, buffer overrun in locate while...

 
 

bug #20014: buffer overrun in locate while reading old-format database

Submitter:  James Youngman <jay>
Submitted:  Wed 30 May 2007 07:13:48 PM UTC
   
 
Category:  locate Severity:  6 - Security
Item Group:  Wrong result Status:  Fixed
Privacy:  Public Assigned to:  jay
Originator Name:  Open/Closed:  Closed
Release:  4.1.20 Fixed Release:  4.2.31
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 30 May 2007 10:11:42 PM UTC, comment #1: 

This problem has been assigned the CVS number CVE-2007-2452.

Findutils supports three different formats of locate database, its native format "LOCATE02", the slocate variant of LOCATE02, and a traditional ("old") format that locate uses on other Unix systems.

When locate reads filenames from a LOCATE02 database (the default format), the buffer into which data is read is automatically extended to accommodate the length of the filenames.

This automatic buffer extension does not happen for old-format
databases.  Instead a 1026-byte buffer is used.  When a longer
pathname appears in the locate database, the end of this buffer is overrun.  The buffer is allocated on the heap (not the stack).

If the locate database is in the default LOCATE02 format, the locate program does perform automatic buffer extension, and the program is not vulnerable to this problem.  The software used to build the old-format locate database is not itself vulnerable to the same attack.

Most installations of GNU findutils do not use the old database
format, and so will not be vulnerable.

(file #12905)

James Youngman <jay>
Group administrator
Wed 30 May 2007 07:13:48 PM UTC, original submission:  

This is a placeholder.

James Youngman <jay>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #12905:  savannah-bug-20014.patch added by jay (3KiB - text/x-patch - Patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jay (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-05-30 jay CategoryNone locate
        Open/ClosedOpen Closed
        Fixed ReleaseNone 4.2.31
    2007-05-30 jay Attached File- Added savannah-bug-20014.patch, #12905
        Severity3 - Normal 6 - Security
        StatusIn Progress Fixed
        PrivacyPrivate Public
        SummaryPlaceholder buffer overrun in locate while reading old-format database

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code