Bug 83685 – net-libs/openslp issues

• Status: RESOLVED DUPLICATE of bug 85347
• Product: Gentoo Security

[Description Sune Kloppenborg Jeppesen (RETIRED) 2005-03-01 07:16:46 UTC]

From Vendor-Sec:

I've had a look at the openslp code (some service-location
protol implementation). Attached is the audit log and a patch
for these issues made by our maintainer. The strcat()
overflow in libslp/libslp_network.c is already fixed
in another diff as I was told so it is missing in the patch.
Issue is not public, if anyone of you also ships this
we should make a timeline.

[Comment 1 Sune Kloppenborg Jeppesen (RETIRED) 2005-03-01 07:19:00 UTC]

Created attachment 52386 [details]
openslp-1.1.5.AUD

[Comment 2 Sune Kloppenborg Jeppesen (RETIRED) 2005-03-01 07:19:24 UTC]

Created attachment 52387 [details, diff]
openslp.audit.diff

[Comment 3 solar (RETIRED) 2005-03-01 07:38:57 UTC]

Package: net-libs/openslp
Maintainer: Error (Missing metadata.xml)

Existing keywords and pkg version.
openslp-1.0.11:  ppc s390 x86 ppc64 arm sparc alpha ia64 mips hppa amd64 

The following people have been involved with this package in the past.

2 [e-mail]
2 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]
1 [e-mail]

[Comment 4 rob holland (RETIRED) 2005-03-10 13:27:14 UTC]

I've had a quick look at the diff and the source code. Specifical sldp_outgoing.c and sldp_incoming.c both trust the value in peek to allocate a buffer.

Pretty sure that can be abused for a heap overflow and be exploitable on systems without chunk-protection malloc patches.

If this needs a serious review please let me know, I've spent very little time on it.

[Comment 5 Sune Kloppenborg Jeppesen (RETIRED) 2005-03-14 10:41:59 UTC]

Now public, but we should probably open a new bug for this if it applies to us.

[Comment 6 Luke Macken (RETIRED) 2005-03-15 07:20:36 UTC]

Closing confidential bug.

*** This bug has been marked as a duplicate of 85347 ***