Multiple Vendor ReadDir_R Buffer Overflow Vulnerability
BID:15259
Info
Multiple Vendor ReadDir_R Buffer Overflow Vulnerability
| Bugtraq ID: | 15259 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 01 2005 12:00AM |
| Updated: | Nov 01 2005 12:00AM |
| Credit: | Ben Hutchings <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
XMail XMail 1.21 XMail XMail 1.0 W3C Libwww 5.3.2 W3C Libwww 3.1 W3C Libwww 4.x teTeX teTeX 2.0.2 teTeX teTeX 2.0.1 teTeX teTeX 2.0 teTeX teTeX 1.0.7 teTeX teTeX 1.0.6 TCL/TK TCL/TK 8.5 a2 TCL/TK TCL/TK 8.4.3 TCL/TK TCL/TK 8.4.2 SAOImage DS9 SAOImage DS9 Roxen WebServer 4.0.402 Roxen WebServer 2.2 Roxen WebServer 2.1.164 Roxen WebServer 2.1 Roxen WebServer 2.0.92 Roxen WebServer 2.0.69 Roxen WebServer 2.0 .X Roxen WebServer 2.0 Roxen WebServer 1.4 .X Roxen WebServer 1.3.122 Roxen WebServer 1.3 .X Roxen WebServer 1.2 .X Roxen WebServer 1.1 .X Roxen WebServer 4.x Roxen WebServer 3.x Pike Pike 7.7 .x Pike Pike 7.6 .x Pike Pike 7.4.327 Pike Pike 7.4 .x Pike Pike 7.2 .x Pike Pike 7.0 .x Pike Pike 0.6 .x Pike Pike 0.5 .x Pike Pike 0.4 pl8 Peter Hofmann xgsmlib OpenOffice OpenOffice 1.1.3 NETW netwib 5.30 .0 NETW netwib 5.1 .0 NcFTP Software NcFTP 3.1.9 NcFTP Software NcFTP 3.1.8 Mike Heffner BFBTester 2.0.1 Mike Heffner BFBTester 2.0 KDE KDE 3.3.2 KDE KDE 3.3.1 KDE KDE 3.3 GNU gjc firstworks Rudiments Library 0.28.2 firstworks Rudiments Library 0.27 Bernhard R. Link reprepro |
| Not Vulnerable: |
XMail XMail 1.22 TCL/TK TCL/TK 8.5 a3 Roxen WebServer 4.0.403 Pike Pike 7.7.22 Pike Pike 7.6.36 Pike Pike 7.4.328 |
Discussion
Multiple Vendor ReadDir_R Buffer Overflow Vulnerability
Certain uses of the 'readdir_r' function may result in a buffer overflow vulnerability. This issue is due to a race condition between the allocation of a memory buffer, and the usage of the buffer in further operations.
Specifically, the 'readdir_r' function fails to specify or require a specific size of memory buffer that it returns its results into. By using a memory buffer that is too small for the result, a buffer overflow may occur.
Attackers may exploit this issue to execute arbitrary machine code in the context of affected applications. Failed exploit attempts will likely result in crashes, denying service to legitimate users.
Operating systems with no difference in the maximum path lengths among differing file systems are not affected by this issue.
Certain uses of the 'readdir_r' function may result in a buffer overflow vulnerability. This issue is due to a race condition between the allocation of a memory buffer, and the usage of the buffer in further operations.
Specifically, the 'readdir_r' function fails to specify or require a specific size of memory buffer that it returns its results into. By using a memory buffer that is too small for the result, a buffer overflow may occur.
Attackers may exploit this issue to execute arbitrary machine code in the context of affected applications. Failed exploit attempts will likely result in crashes, denying service to legitimate users.
Operating systems with no difference in the maximum path lengths among differing file systems are not affected by this issue.
Exploit / POC
Multiple Vendor ReadDir_R Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Multiple Vendor ReadDir_R Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple Vendor ReadDir_R Buffer Overflow Vulnerability
References:
References:
- readdir_r considered harmful (Ben Hutchings)
- readdir_r considered harmful (Ben Hutchings