Bochs Buffer Overflow and Denial Of Service Vulnerabilities
BID:24246
Info
Bochs Buffer Overflow and Denial Of Service Vulnerabilities
| Bugtraq ID: | 24246 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-2894 CVE-2007-2893 |
| Remote: | No |
| Local: | Yes |
| Published: | May 31 2007 12:00AM |
| Updated: | Nov 19 2007 04:04PM |
| Credit: | Tavis Ormandy is credited with discovering these issues. |
| Vulnerable: |
Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Bochs Bochs 2.3 |
| Not Vulnerable: | |
Discussion
Bochs Buffer Overflow and Denial Of Service Vulnerabilities
Bochs is prone to a heap-based buffer-overflow issue and a denial-of-service issue. The buffer-overflow issue occurs because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. The denial-of-service vulnerability is caused by a divide-by-zero operation.
A local attacker can exploit these issues to execute arbitrary code in the context of the affected application or to cause denial-of-service conditions. Failed exploit attempts of the buffer-overflow vulnerability will also result in denial-of-service conditions.
Bochs is prone to a heap-based buffer-overflow issue and a denial-of-service issue. The buffer-overflow issue occurs because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. The denial-of-service vulnerability is caused by a divide-by-zero operation.
A local attacker can exploit these issues to execute arbitrary code in the context of the affected application or to cause denial-of-service conditions. Failed exploit attempts of the buffer-overflow vulnerability will also result in denial-of-service conditions.
Exploit / POC
Bochs Buffer Overflow and Denial Of Service Vulnerabilities
The following proof of concept is available:
The following proof of concept is available:
Solution / Fix
Bochs Buffer Overflow and Denial Of Service Vulnerabilities
Solution:
Updates are available to address this issue. Please see the references for more information.
Solution:
Updates are available to address this issue. Please see the references for more information.
References
Bochs Buffer Overflow and Denial Of Service Vulnerabilities
References:
References:
- An Empirical Study into the Security Exposure to Hosts of Hostile Virtualized En (Tavis Ormandy)
- Bochs Homepage (Bochs)