bugfindutils - Bugs: bug #20014, buffer overrun in locate while...

 
 

bug #20014: buffer overrun in locate while reading old-format database

Submitted by:  James Youngman <jay>
Submitted on:  Wed 30 May 2007 07:13:48 PM UTC  
 
Category: locateSeverity: 6 - Security
Item Group: Wrong resultStatus: Fixed
Privacy: PublicAssigned to: James Youngman <jay>
Originator Name: Open/Closed: Closed
Release: 4.1.20Fixed Release: 4.2.31

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 30 May 2007 10:11:42 PM UTC, comment #1:

This problem has been assigned the CVS number CVE-2007-2452.

Findutils supports three different formats of locate database, its native format "LOCATE02", the slocate variant of LOCATE02, and a traditional ("old") format that locate uses on other Unix systems.

When locate reads filenames from a LOCATE02 database (the default format), the buffer into which data is read is automatically extended to accommodate the length of the filenames.

This automatic buffer extension does not happen for old-format
databases. Instead a 1026-byte buffer is used. When a longer
pathname appears in the locate database, the end of this buffer is overrun. The buffer is allocated on the heap (not the stack).

If the locate database is in the default LOCATE02 format, the locate program does perform automatic buffer extension, and the program is not vulnerable to this problem. The software used to build the old-format locate database is not itself vulnerable to the same attack.

Most installations of GNU findutils do not use the old database
format, and so will not be vulnerable.

(file #12905)

James Youngman <jay>
Project AdministratorIn charge of this item.
Wed 30 May 2007 07:13:48 PM UTC, original submission:

This is a placeholder.

James Youngman <jay>
Project AdministratorIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #12905:  savannah-bug-20014.patch added by jay (3KiB - text/x-patch - Patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jay (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 30 May 2007 10:13:18 PM UTCjayCategoryNone=>locate
      Open/ClosedOpen=>Closed
      Fixed ReleaseNone=>4.2.31
    Wed 30 May 2007 10:11:42 PM UTCjayAttached File-=>Added savannah-bug-20014.patch, #12905
      Severity3 - Normal=>6 - Security
      StatusIn Progress=>Fixed
      PrivacyPrivate=>Public
      SummaryPlaceholder=>buffer overrun in locate while reading old-format database

    Back to the top


    Powered by Savane 3.1-cleanup1