Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 268643 (CVE-2009-1956) - <dev-libs/apr-util-1.3.5: Off-by-one in apr_brigade_vprintf() (CVE-2009-1956)
Summary: <dev-libs/apr-util-1.3.5: Off-by-one in apr_brigade_vprintf() (CVE-2009-1956)
Status: RESOLVED FIXED
Alias: CVE-2009-1956
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
URL: http://svn.apache.org/viewvc?view=rev...
Whiteboard: B3 [glsa]
Keywords:
Depends on: CVE-2009-1955
Blocks:
  Show dependency tree
 
Reported: 2009-05-04 17:47 UTC by Duncan Exon Smith
Modified: 2009-07-04 07:49 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Patch to remove an unnessary null terminator that causes a buffer overflow. (1.3.4-apr_brigade_vprintf-skip_null_terminator.patch,507 bytes, patch)
2009-05-04 17:51 UTC, Duncan Exon Smith
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Duncan Exon Smith 2009-05-04 17:47:27 UTC
I have 'svnsync' failing with the following message:
 svnsync: Got unexpected element svn::open_directory

The next revision to commit has a lot of property changes.  A google turned up the following threads, pointing to a problem with dev-libs/apr-util
 http://subversion.tigris.org/ds/viewMessage.do?dsForumId=462&viewType=browseAll&dsMessageId=1897250
 http://subversion.tigris.org/ds/viewMessage.do?dsForumId=462&viewType=browseAll&dsMessageId=1745697
The folks at CollabNet committed the following to the 'apr' trunk:
 http://svn.apache.org/viewvc/apr/apr/trunk/buckets/apr_brigade.c?r1=768417&r2=768416&pathrev=768417

Installing 'dev-libs/apr-util-1.3.4' with a patch for the above changeset and 'rc-config restart apache2' fixes the problem for me.

Reproducible: Always
Comment 1 Duncan Exon Smith 2009-05-04 17:51:05 UTC
Created attachment 190333 [details, diff]
Patch to remove an unnessary null terminator that causes a buffer overflow.

Here is the patch I applied locally.  It's the same as the following commit to the apr trunk:
 http://svn.apache.org/viewvc/apr/apr/trunk/buckets/apr_brigade.c?r1=768417&r2=768416&pathrev=768417
Comment 2 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev 2009-06-06 20:29:09 UTC
dev-libs/apr-1.3.5 was released on 2009-06-05.
dev-libs/apr-util-1.3.7 was released on 2009-06-05.
Comment 3 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-06-06 20:51:41 UTC
======================================================
Name: CVE-2009-1956
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1956

Off-by-one error in the apr_brigade_vprintf function in Apache
APR-util before 1.3.5 on big-endian platforms allows remote attackers
to obtain sensitive information or cause a denial of service
(application crash) via crafted input.
Comment 4 Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev 2009-06-08 21:14:00 UTC
dev-libs/apr-1.3.5 and dev-libs/apr-util-1.3.7 are now in the tree.
Comment 5 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-06-26 08:48:58 UTC
GLSA together with bug 272260.
Comment 6 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-07-04 07:49:31 UTC
GLSA 200907-03