[oss-security] Re: CVE request: possible miniupnpc buffer overflow

2014-06-13T00:00:00
ID SECURITYVULNS:DOC:30803
Type securityvulns
Reporter Securityvulns
Modified 2014-06-13T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

> It was pointed out in > https://bugzilla.redhat.com/show_bug.cgi?id=1085618 that miniupnpc > version 1.9 fixes a possible buffer overflow: > > https://github.com/miniupnp/miniupnp/commit/3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9

> On a related note ... in version 1.9, miniwget.c: > > 173 n = header_buf_used - endofheaders; > 174 memcpy(buf, header_buf + endofheaders, n); > > Mixing the types together (and the signed int in the memcpy) may warrant > further investigation.

> From: Murray McAllister <mmcallis@redhat.com> > Date: Thu, 01 May 2014 10:35:27 +1000 > Subject: Re: [oss-security] CVE request: possible miniupnpc buffer overflow

>> Mixing the types together (and the signed int in the memcpy) may warrant >> further investigation.

> Upstream investigated this and found it to be safe.

Use CVE-2014-3985 for the buffer overflow.

In the "investigated this and found it to be safe" sentence, "this" means only the second part of the original message, not the part about the buffer overflow. The while loop in the unpatched code before 3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9 was not found to be safe. (For many people reading the second message, this may have been obvious because the "safe" sentence came after quoted text from only the second part of the original message.)


CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTkn2vAAoJEKllVAevmvmsqxoIALD6sDb3SvERks8sXZBRxTs2 CqC4ruw8M6zUXqaeO8U7wCr+2xQn+M+DDFmX9MmxoGVtQd0QPD+gZejXnwSIBj7v yCrBUAwvlU2u2hjPmOxSsXzgSSy+xdsXxiRMK4rqdN1RI5dgzTwHE5t+txwAKR0c Sq3Z0v63rCzb122M/diVfXYos8nCTG+2AwtIOFd1zkbCoHRFdfHdeHjXl1jbYhRU +WKGHudUeNjqAyxg00PDpbz5KRo8zWpEMhQF9o8q5yY1lZyeo0A7iWXweGRb4g0M WANluLwi+12nc24zeViNUN/9rdjO3BCXQ7hYwTQLjQKUEmpfDSInlG1giZac0Tc= =D1eB -----END PGP SIGNATURE-----