Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names
From: Matthias Weckbecker <mweckbecker () suse de>
Date: Thu, 22 Nov 2012 10:48:05 +0100

Hi Jan, Steve, Raphael, Attila, ...,

On Tuesday 20 November 2012 12:57:11 Jan Lieskovsky wrote:
Hi Steve,

----- Original Message -----



Previously considered scenario was remote user would trick the local one to
decrypt provided file (obviously the local user might not check if filename
isn't too long prior decryption). But after further review looks mcrypt
doesn't support asymmetric cryptography / keys (which I didn't know in the
moment of requesting a CVE id), only the symmetric one, which makes this
scenario impossible / unlikely.

Considering the above, I think you are right and CVE-2012-4527 should be
probably rejected.

And what about CVE-2012-4426 then? The same applies there too, right? Reject?

Right now I can't think of a case, how this could be possible to (mis)use
for an attack.

A program that runs with higher privileges and executes mcrypt with external
user-controlled input possibly? Maybe a bit far fetched, but not impossible.



Matthias Weckbecker, Senior Security Engineer, SUSE Security Team
SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg, Germany
Tel: +49-911-74053-0;  http://suse.com/
SUSE LINUX Products GmbH, GF: Jeff Hawn, HRB 16746 (AG Nuernberg) 

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]