Bug 450284 – <dev-lang/swi-prolog-6.2.5: Multiple (stack-based) buffer overflows in patch canonisation code and when expanding file-names with long paths (CVE-2012-{6089,6090})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-01-04 19:48:27 UTC]

From $URL :

SWI-Prolog upstream has released [2] 6.2.5 / 6.3.7 versions,
correcting the following two security flaws:

* Issue #1 (from [2]):
=======================
* FIXED: Possible buffer overrun in patch canonisation code.
Pushes pointers on an automatic array without checking for
overflow.  Can be used for DoS attacks. Will be extremely
hard to make it execute arbitrary code.

Relevant upstream patch:
[1] http://www.swi-prolog.org/git/pl.git/commitdiff/a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c

References:
[2] https://lists.iai.uni-bonn.de/pipermail/swi-prolog/2012/009428.html
[3] https://bugzilla.redhat.com/show_bug.cgi?id=891577

* Issue #2 - from [2]:
======================
* SECURITY: Possible buffer overflows when expanding file-names with
long paths.  Affects expand_file_name/2.  Can lead to crashes
(DoS attacks) and possibly execution of arbitrary code if an attacker
can control the names of the files searched for, e.g., if
expand_file_name/2 is used in a directory to which an attacker can
upload files for which he can control the name.

Relevant upstream patch:
[4] http://www.swi-prolog.org/git/pl.git/commitdiff/b2c88972e7515ada025e97e7d3ce3e34f81cf33e

References:
[5] https://lists.iai.uni-bonn.de/pipermail/swi-prolog/2012/009428.html
[6] https://bugzilla.redhat.com/show_bug.cgi?id=891577

[Comment 1 GLSAMaker/CVETool Bot 2013-01-06 13:58:34 UTC]

CVE-2012-6090 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6090):
  Multiple stack-based buffer overflows in the expand function in os/pl-glob.c
  in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to
  cause a denial of service (application crash) or possibly execute arbitrary
  code via a crafted filename.

CVE-2012-6089 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6089):
  Multiple stack-based buffer overflows in the canoniseFileName function in
  os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote
  attackers to cause a denial of service (application crash) or possibly
  execute arbitrary code via a crafted filename.

[Comment 2 Keri Harris 2013-01-08 14:07:57 UTC]

-6.2.5 and -6.3.7 are both in portage.

=dev-lang/swi-prolog-6.2.5 is the version recommended for stabilization.

[Comment 3 Sean Amoss (RETIRED) 2013-01-16 00:09:15 UTC]

(In reply to comment #2)
> -6.2.5 and -6.3.7 are both in portage.
> 
> =dev-lang/swi-prolog-6.2.5 is the version recommended for stabilization.

Thanks, Keri. 

Arches, please test and mark stable.

[Comment 4 Agostino Sarubbo 2013-01-16 11:22:44 UTC]

amd64 stable

[Comment 5 Agostino Sarubbo 2013-01-21 12:44:14 UTC]

x86 stable

[Comment 6 Agostino Sarubbo 2013-01-21 14:05:26 UTC]

ppc stable

[Comment 7 Sean Amoss (RETIRED) 2013-01-21 22:27:53 UTC]

New GLSA request filed.

[Comment 8 GLSAMaker/CVETool Bot 2013-12-06 05:55:13 UTC]

This issue was resolved and addressed in
 GLSA 201312-05 at http://security.gentoo.org/glsa/glsa-201312-05.xml
by GLSA coordinator Sergey Popov (pinkbyte).