Bug 399409 – <app-pda/usbmuxd-1.0.7-r1: "receive_packet()" Buffer Overflow Vulnerability (CVE-2012-0065)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2012-01-19 17:56:23 UTC]

From secunia security advisory at $URL:

Description:
The vulnerability is caused due to a boundary error within the "receive_packet()" function (libusbmuxd/libusbmuxd.c) when processing a property list containing an overly long "SerialNumber" field, which can be exploited to cause a heap-based buffer overflow.

Successful exploitation may allow the execution of arbitrary code, but requires that the attacker is able to connect a malicious USB device.


Solution:
Fixed in the GIT repository.
http://git.marcansoft.com/?p=usbmuxd.git;a=commitdiff;h=f794991993af56a74795891b4ff9da506bc893e6

[Comment 1 Samuli Suominen (RETIRED) 2012-01-19 18:05:13 UTC]

Fixed by 1.0.7-r1, CCing amd64 and x86

[Comment 2 Agostino Sarubbo 2012-01-19 22:21:20 UTC]

amd64 stable

[Comment 3 Thomas Kahle (RETIRED) 2012-01-23 14:11:08 UTC]

x86 stable.  No hardware to test, though

[Comment 4 Agostino Sarubbo 2012-01-23 14:31:10 UTC]

Filed new request.

[Comment 5 GLSAMaker/CVETool Bot 2012-03-06 02:13:42 UTC]

This issue was resolved and addressed in
 GLSA 201203-11 at http://security.gentoo.org/glsa/glsa-201203-11.xml
by GLSA coordinator Sean Amoss (ackle).