Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 623152 (CVE-2017-9847) - <net-libs/libtorrent-rasterbar-1.1.5-r1: Heap-buffer overflow in bdecode function
Summary: <net-libs/libtorrent-rasterbar-1.1.5-r1: Heap-buffer overflow in bdecode func...
Status: RESOLVED FIXED
Alias: CVE-2017-9847
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on: 641336
Blocks:
  Show dependency tree
 
Reported: 2017-06-30 09:45 UTC by Agostino Sarubbo
Modified: 2018-11-24 11:15 UTC (History)
2 users (show)

See Also:
Package list:
net-libs/libtorrent-rasterbar-1.1.5-r1
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2017-06-30 09:45:39 UTC 
From ${URL} :

The bdecode function in bdecode.cpp in libtorren allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.

Upstream issue:

https://github.com/arvidn/libtorrent/issues/2099

Upstream patch:

https://github.com/arvidn/libtorrent/commit/ec30a5e9ec703afb8abefba757c6d401303b53db


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Andreas Sturmlechner gentoo-dev 2017-10-15 21:35:30 UTC 
1.1.5 version bump which contains the fix added to tree in git commit ba2bd6037f03559b49ee56462e0ffd0606d71aa8
Comment 2 Sławomir Nizio 2017-10-16 18:02:08 UTC 
Note that net-p2p/deluge-1.3.15 has this:

 CDEPEND="<net-libs/libtorrent-rasterbar-1.1[python,${PYTHON_USEDEP}]"
Comment 3 Andreas Sturmlechner gentoo-dev 2017-10-20 22:27:40 UTC 
(In reply to Sławomir Nizio from comment #2)
>  CDEPEND="<net-libs/libtorrent-rasterbar-1.1[python,${PYTHON_USEDEP}]"
That may be sad for deluge users but at least it means they got their dependencies right.
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2017-11-05 21:29:26 UTC 
x86 stable
Comment 5 Manuel Rüger (RETIRED) gentoo-dev 2017-11-07 13:12:15 UTC 
amd64 stable
Comment 6 Sergei Trofimovich (RETIRED) gentoo-dev 2017-11-12 11:36:01 UTC 
ppc64 stable
Comment 7 Sergei Trofimovich (RETIRED) gentoo-dev 2017-11-13 22:39:29 UTC 
ppc stable
Comment 8 Larry the Git Cow gentoo-dev 2018-02-04 17:39:51 UTC 
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7bf75899ab29cb7f927d6954b0969f5e3c73d3dc

commit 7bf75899ab29cb7f927d6954b0969f5e3c73d3dc
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2018-02-04 17:10:25 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2018-02-04 17:38:55 +0000

    net-libs/libtorrent-rasterbar: Cleanup vulnerable
    
    Stabilisation timeout.
    
    Closes: https://bugs.gentoo.org/623152
    Package-Manager: Portage-2.3.24, Repoman-2.3.6

 net-libs/libtorrent-rasterbar/Manifest             |   1 -
 ...rent-rasterbar-1.0.11-boost-config-header.patch |  31 ----
 ...libtorrent-rasterbar-1.0.11-fix-abicompat.patch | 157 ---------------------
 .../libtorrent-rasterbar-1.0.11-fix-test_ssl.patch |  21 ---
 .../libtorrent-rasterbar-1.0.11-move-header.patch  |  34 -----
 ...orrent-rasterbar-1.0.9-test_torrent_parse.patch |  41 ------
 .../libtorrent-rasterbar-1.0.11-r1.ebuild          | 117 ---------------
 7 files changed, 402 deletions(-)
Comment 9 Andreas Sturmlechner gentoo-dev 2018-02-04 21:56:49 UTC 
Cleanup done, I guess security can do their thing now.
Comment 10 Aaron Bauman (RETIRED) gentoo-dev 2018-02-04 22:40:27 UTC 
(In reply to Andreas Sturmlechner from comment #9)
> Cleanup done, I guess security can do their thing now.

Thanks, Andreas!

GLSA Vote: No
Comment 11 Andreas Sturmlechner gentoo-dev 2018-02-05 05:51:46 UTC 
'what was I thinking?' Temporarily restored for bug 641336.
Comment 12 Larry the Git Cow gentoo-dev 2018-02-22 21:49:01 UTC 
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=57d52572cbe8d2586523a66b0f6bbc6254f7edc0

commit 57d52572cbe8d2586523a66b0f6bbc6254f7edc0
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2018-02-22 21:47:44 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2018-02-22 21:48:41 +0000

    net-libs/libtorrent-rasterbar: Cleanup vulnerable
    
    Closes: https://bugs.gentoo.org/623152

 net-libs/libtorrent-rasterbar/Manifest             |   1 -
 ...rent-rasterbar-1.0.11-boost-config-header.patch |  31 ----
 ...libtorrent-rasterbar-1.0.11-fix-abicompat.patch | 157 ---------------------
 .../libtorrent-rasterbar-1.0.11-fix-test_ssl.patch |  21 ---
 .../libtorrent-rasterbar-1.0.11-move-header.patch  |  34 -----
 ...orrent-rasterbar-1.0.9-test_torrent_parse.patch |  41 ------
 .../libtorrent-rasterbar-1.0.11-r1.ebuild          | 117 ---------------
 7 files changed, 402 deletions(-)