Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 208001 (CVE-2007-4770) - dev-libs/icu <= 3.8.1 Regular Expressions Vulnerabilities (CVE-2007-(4770|4771))
Summary: dev-libs/icu <= 3.8.1 Regular Expressions Vulnerabilities (CVE-2007-(4770|4771))
Status: RESOLVED FIXED
Alias: CVE-2007-4770
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
URL: http://secunia.com/advisories/28575
Whiteboard: B1 [glsa]
Keywords:
: 207905 (view as bug list)
Depends on:
Blocks: 206889
  Show dependency tree
 
Reported: 2008-01-29 07:34 UTC by Lars Hartmann
Modified: 2008-03-11 22:16 UTC (History)
6 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Lars Hartmann 2008-01-29 07:34:24 UTC
Will Drewry has reported some vulnerabilities in International Components for Unicode, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library.

1) A regular expression containing a back reference to capture group zero (\0) may reference random memory areas, which can be exploited to crash an application using the library.

2) The library does not limit the size of the backtracking stack. This can be exploited to cause a heap-based buffer overflow via certain specially crafted regular expressions.

The vulnerability is reported in version 3.8.1. Other versions may also be affected.

Solution:
Apply patch.
http://source.icu-project.org/repos/icu/icu/branches/maint/maint-3-8
Comment 1 Lars Hartmann 2008-01-29 07:37:00 UTC
maintainers - please provide an updated ebuild
Comment 2 Jakub Moc (RETIRED) gentoo-dev 2008-01-29 08:17:50 UTC
*** Bug 207905 has been marked as a duplicate of this bug. ***
Comment 3 Robert Buchholz (RETIRED) gentoo-dev 2008-02-01 22:51:47 UTC
ping
Comment 4 Robert Buchholz (RETIRED) gentoo-dev 2008-02-01 23:35:32 UTC
I reproduced the 4771 issue on 3.6.1.
Caolan McNamara from RedHat backported the patches to 3.6:
  https://bugzilla.redhat.com/show_bug.cgi?id=429023

This bug also affects OpenOffice, as it currently uses an internal copy of icu.
OpenOffice herd, please advise here.
Comment 5 Robert Buchholz (RETIRED) gentoo-dev 2008-02-02 00:06:31 UTC
OpenOffice, please try building against the (security patched) libicu 3.8.1-r1 here:  http://overlays.gentoo.org/svn/proj/php/migration/dev-libs/icu/

If that does not work, please patch the copy of icu.
Comment 6 Andreas Proschofsky (RETIRED) gentoo-dev 2008-02-02 18:27:58 UTC
(In reply to comment #5)
> OpenOffice, please try building against the (security patched) libicu 3.8.1-r1
> here:  http://overlays.gentoo.org/svn/proj/php/migration/dev-libs/icu/
> 
> If that does not work, please patch the copy of icu.
> 

I've added a new revision (-r1) of openoffice-2.3.1 to portage, this uses external icu again (we had to back this out prior to stabilizing 2.3.1 as it was broken in OOo), works fine here on x86, other archs will have to test accordingly
Comment 7 Christian Hoffmann (RETIRED) gentoo-dev 2008-02-02 21:56:35 UTC
icu-3.8.1-r1 with the patch is in the tree now, thanks to jakub. I did not do any tests except from compiling (I haven't touched that package before anyway). I might try building OOo tomorrow, but certainly not today.
Comment 8 Christian Hoffmann (RETIRED) gentoo-dev 2008-02-02 22:24:27 UTC
icu-3.6-r2 in the tree as well (with the patch from redhat). You probably want 3.8* stable for OpenOffice anyway, but I don't really know, ask jakub if in doubt. ;)
Comment 9 Jakub Moc (RETIRED) gentoo-dev 2008-02-03 08:54:55 UTC
(In reply to comment #8)
> icu-3.6-r2 in the tree as well (with the patch from redhat). You probably want
> 3.8* stable for OpenOffice anyway, but I don't really know, ask jakub if in
> doubt. ;)

Well, yes, definitely. It won't compile with ~icu-3.6. arches, please test and stabilize the following:

dev-libs/icu-3.6-r2 (will be hanging around for dev-libs/xerces-c-2.8.0 at least unless someone fixes the messy thing to work w/ icu-3.8.x)

dev-libs/icu-3.8.1-r1
Comment 10 Brent Baude (RETIRED) gentoo-dev 2008-02-03 18:51:14 UTC
ppc and ppc64 done.  

dertobi123 tested ppc and I committed for his convenience.
Comment 11 Jeroen Roovers gentoo-dev 2008-02-03 23:24:37 UTC
Stable for HPPA.
Comment 12 Christian Faulhammer (RETIRED) gentoo-dev 2008-02-04 14:37:16 UTC
x86 stable
Comment 13 Raúl Porcel (RETIRED) gentoo-dev 2008-02-07 10:39:53 UTC
alpha/ia64/sparc stable
Comment 14 Olivier Crete (RETIRED) gentoo-dev 2008-02-10 22:51:08 UTC
amd64 done
Comment 15 Jakub Moc (RETIRED) gentoo-dev 2008-02-11 09:56:15 UTC
(In reply to comment #14)
> amd64 done

You missed dev-libs/icu-3.6-r2; thanks.

Comment 16 Steve Dibb (RETIRED) gentoo-dev 2008-02-20 04:17:22 UTC
(In reply to comment #15)
> (In reply to comment #14)
> > amd64 done
> 
> You missed dev-libs/icu-3.6-r2; thanks.
> 

done
Comment 17 Peter Volkov (RETIRED) gentoo-dev 2008-02-23 17:54:38 UTC
Updated in release snapshot.
Comment 18 Pierre-Yves Rofes (RETIRED) gentoo-dev 2008-03-11 22:16:52 UTC
GLSA 200803-20