Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 530734 - app-misc/hivex: missing checks for small-sized files
Summary: app-misc/hivex: missing checks for small-sized files
Status: RESOLVED DUPLICATE of bug 490990
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B2 [ebuild]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-11-26 09:05 UTC by Agostino Sarubbo
Modified: 2014-11-27 06:26 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-11-26 09:05:50 UTC
From ${URL} :

It was reported that hivex [1], a library that can read and write hive files (undocumented binary 
files that Windows uses to store the Windows Registry on disk), did not properly handle small-sized 
hive files. An attacker able to supply a hive file of a small size to an application using the 
hivex library could use this flaw to read, and possibly write, up to 4095 bytes beyond the end of 
the allocated buffer, potentially resulting in arbitrary code execution with the with the 
privileges of the user running that application.

This issue has been fixed in upstream version 3.11 of hivex. Upstream patches are available at:

https://github.com/libguestfs/hivex/commit/357f26fa64fd1d9ccac2331fe174a8ee9c607adb
https://github.com/libguestfs/hivex/commit/4bbdf555f88baeae0fa804a369a81a83908bd705

Reproducer: https://bugzilla.redhat.com/show_bug.cgi?id=1158992#c0

[1] https://www.redhat.com/archives/libguestfs/2014-October/msg00235.html



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Yury German Gentoo Infrastructure gentoo-dev Security 2014-11-27 06:26:28 UTC

*** This bug has been marked as a duplicate of bug 490990 ***