Bug 390769 – <app-text/chasen-2.4.4-r2: Unspecified vulnerability (CVE-2011-4000)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2011-11-17 00:03:52 UTC]

CVE-2011-4000 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4000):
  Buffer overflow in ChaSen 2.4.x allows remote attackers to execute arbitrary
  code via a crafted string.


JPCERT Advisory at https://jvn.jp/jp/JVN16901583/index.html.

[Comment 1 Naohiro Aota 2011-11-21 08:11:32 UTC]

http://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000099.html
> Solution
> 
>     [Do not use ChaSen]
>     According to the developer, there are no plans for ChaSen to be updated or maintained. Therefore, it is recommended to consider using a different product that provides similar functionality.
> 
>     [Apply a workaround]
>     According to the developer, this vulnerability occurred when adding functionality to the ChaSen 2.4 series.
>     For software developers that would like to continue using ChaSen, applying the following workaround will mitigate the effects of this vulnerability.
> 
>     * Use ChaSen version 2.3.3 

Upstream won't release the fix... I'm thinking to remove the package.

<naota> !ddep chasen  [17:03]
<willikins> naota: Reverse DEPEND for app-text/chasen: app-dicts/ipadic-2.7.0
	    app-dicts/ipadic-2.7.0-r1 app-dicts/ipadic-2.7.0-r2
	    app-text/namazu-2.0.18:chasen app-text/namazu-2.0.19:linguas_ja
	    app-text/namazu-2.0.19-r1:linguas_ja
	    app-text/namazu-2.0.20:linguas_ja
	    app-text/namazu-2.0.21:linguas_ja dev-ruby/ruby-chasen-1.7-r1
<naota> !rdep chasen
<willikins> naota: Reverse RDEPEND for app-text/chasen: app-dicts/ipadic-2.7.0
	    app-text/namazu-2.0.18:chasen app-text/namazu-2.0.19:linguas_ja
	    app-text/namazu-2.0.19-r1:linguas_ja
	    app-text/namazu-2.0.20:linguas_ja
	    app-text/namazu-2.0.21:linguas_ja dev-ruby/ruby-chasen-1.7-r1

namazu works without chasen (chasen is optional dependency, namazu work with kakashi or mecab)

Need to drop
- chasen
- ipadic
- ruby-chasen

[Comment 2 Tim Sammut (RETIRED) 2011-11-22 16:37:15 UTC]

(In reply to comment #1) 
> 
> Upstream won't release the fix... I'm thinking to remove the package.
> 

...

> Need to drop
> - chasen
> - ipadic
> - ruby-chasen

This sounds like a reasonable approach to me. Do you mind doing it?

[Comment 3 Naohiro Aota 2011-11-24 04:07:33 UTC]

Masked for removale.

+# Naohiro Aota <[e-mail]> (24 Nov 2011)
+# Masked for removal in 30 days
+# due to end of support (upstream) and
+# security issue: bug 390769
+app-text/chasen
+app-dicts/ipadic
+dev-ruby/ruby-chasen

[Comment 4 Rafał Mużyło 2011-12-02 09:58:29 UTC]

I'm not quite sure, but it seems http://git.sourceforge.jp/view?p=chasen-legacy/chasen.git;a=commitdiff;h=05f4be730e9e672bfeae867d9f23055aa3e72ee1 is supposed to be the fix.

Though that doesn't change "end of support" part.

[Comment 5 df 2011-12-07 06:33:22 UTC]

(In reply to comment #4)
> I'm not quite sure, but it seems
> http://git.sourceforge.jp/view?p=chasen-legacy/chasen.git;a=commitdiff;h=05f4be730e9e672bfeae867d9f23055aa3e72ee1
> is supposed to be the fix.
> 
> Though that doesn't change "end of support" part.

It is pushed by chasen package maintainer @ Debian.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648359

I'm not sure either. Does it seem to be reviwed now?

[Comment 6 df 2011-12-08 16:19:29 UTC]

patch (chasen244-secfix.diff) has been released officaily.
http://sourceforge.jp/projects/chasen-legacy/releases/?package_id=5861
# same as http://git.sourceforge.jp/view?p=chasen-legacy/chasen.git;a=commitdiff;h=05f4be730e9e672bfeae867d9f23055aa3e72ee1

but it is not changed "end of support" situation as Rafał said probably..

[Comment 7 Naohiro Aota 2011-12-18 06:33:28 UTC]

Added the security fix. Could you test the package? I'll drop the mask then.

[Comment 8 Pacho Ramos 2012-03-18 12:46:20 UTC]

Any updates here? mask entry still tells people this is masked for removal in 30 days...

[Comment 9 Naohiro Aota 2012-03-19 06:59:38 UTC]

(In reply to comment #8)
> Any updates here? mask entry still tells people this is masked for removal
> in 30 days...

The security fixed version seems fine. I've dropped the mask.

[Comment 10 df 2012-04-08 10:10:13 UTC]

it's time to arch tests?

[Comment 11 Tim Sammut (RETIRED) 2012-04-08 15:38:09 UTC]

(In reply to comment #9)
> 
> The security fixed version seems fine. I've dropped the mask.

packages.g.o is still showing this masked, although I am not sure why, I don't see the mask locally.

(In reply to comment #10)
> it's time to arch tests?

Yes, please.

Arches, please test and mark stable:
=app-text/chasen-2.4.4-r2
Target keywords : "amd64 ppc ppc64 sparc x86"

[Comment 12 df 2012-04-08 22:07:45 UTC]

(In reply to comment #6)
> but it is not changed "end of support" situation as Rafał said probably..

quote from http://jvn.jp/en/jp/JVN16901583/index.html :
> ChaSen legacy project has inherited development of  ChaSen since 11/8/2011.

@Maintainer,
Please care about Bug 411297 I filed.

[Comment 13 Andreas Schürch 2012-04-10 20:14:41 UTC]

x86 stable.

[Comment 14 Brent Baude (RETIRED) 2012-04-15 16:01:00 UTC]

ppc done

[Comment 15 Agostino Sarubbo 2012-04-16 12:49:50 UTC]

amd64 stable

[Comment 16 Mark Loeser (RETIRED) 2012-05-06 19:05:10 UTC]

moved to ~ppc64, thus we are done

[Comment 17 Raúl Porcel (RETIRED) 2012-06-09 19:10:08 UTC]

sparc keywords dropped

[Comment 18 Tim Sammut (RETIRED) 2012-06-10 15:40:43 UTC]

Thanks, folks. Already in GLSA request.

[Comment 19 GLSAMaker/CVETool Bot 2012-07-09 22:23:46 UTC]

This issue was resolved and addressed in
 GLSA 201207-03 at http://security.gentoo.org/glsa/glsa-201207-03.xml
by GLSA coordinator Sean Amoss (ackle).