libHX 'HX_split()' Remote Heap-Based Buffer Overflow Vulnerability

Bugtraq ID:	42592
Class:	Boundary Condition Error
CVE:	CVE-2010-2947
Remote:	Yes
Local:	No
Published:	Aug 20 2010 12:00AM
Updated:	Apr 16 2015 06:04PM
Credit:	Jan Engelhardt
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise 11 SP1 SuSE SUSE Linux Enterprise 11 SuSE openSUSE 11.3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0
Not Vulnerable:

libHX 'HX_split()' Remote Heap-Based Buffer Overflow Vulnerability

libHX is prone to a remote heap-based buffer-overflow vulnerability because it fails to properly validate user-supplied input.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the application that uses the affected library. Failed exploit attempts may result in a denial-of-service condition.

libHX 3.5 is affected; other versions may also be vulnerable.

libHX 'HX_split()' Remote Heap-Based Buffer Overflow Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

libHX 'HX_split()' Remote Heap-Based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu libhx-dev_2.9-3ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_2.9-3ubuntu0.1_ sparc.deb


• Ubuntu libhx-doc_2.9-3ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-doc_2.9-3ubuntu0.1_ sparc.deb


• Ubuntu libhx18_2.9-3ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx18_2.9-3ubuntu0.1_sp arc.deb

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva lib64HX-devel-2.5-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64HX18-2.5-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu libhx-dev_1.10.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_1.10.2-2ubuntu0 .1_powerpc.deb


• Ubuntu libhx10_1.10.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx10_1.10.2-2ubuntu0.1 _powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu libhx-dev_1.10.2-2ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_1.10.2-2ubuntu0 .1_sparc.deb


• Ubuntu libhx10_1.10.2-2ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx10_1.10.2-2ubuntu0.1 _sparc.deb

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu libhx-dev_2.9-3ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_2.9-3ubuntu0.1_ powerpc.deb


• Ubuntu libhx-doc_2.9-3ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-doc_2.9-3ubuntu0.1_ powerpc.deb


• Ubuntu libhx18_2.9-3ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx18_2.9-3ubuntu0.1_po werpc.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu libhx-dev_1.10.2-2ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-dev_1.10. 2-2ubuntu0.1_amd64.deb


• Ubuntu libhx10_1.10.2-2ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx10_1.10.2- 2ubuntu0.1_amd64.deb

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu libhx-dev_2.9-3ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_2.9-3ubuntu0.1_ lpia.deb


• Ubuntu libhx-doc_2.9-3ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-doc_2.9-3ubuntu0.1_ lpia.deb


• Ubuntu libhx18_2.9-3ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx18_2.9-3ubuntu0.1_lp ia.deb

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva lib64HX-devel-3.4-1.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64HX22-3.4-1.1mdv2010.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu libhx-dev_1.28-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_1.28-1ubuntu0.1 _sparc.deb


• Ubuntu libhx14_1.28-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx14_1.28-1ubuntu0.1_s parc.deb

Mandriva Linux Mandrake 2010.0

• Mandriva libHX-devel-3.1-1.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libHX22-3.1-1.1mdv2010.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu libhx-dev_1.28-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_1.28-1ubuntu0.1 _powerpc.deb


• Ubuntu libhx14_1.28-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx14_1.28-1ubuntu0.1_p owerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu libhx-dev_1.10.2-2ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_1.10.2-2ubuntu0 .1_lpia.deb


• Ubuntu libhx10_1.10.2-2ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx10_1.10.2-2ubuntu0.1 _lpia.deb

Mandriva Linux Mandrake 2010.0 x86_64

• Mandriva lib64HX-devel-3.1-1.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64HX22-3.1-1.1mdv2010.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.04 powerpc

• Ubuntu libhx-dev_3.2-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_3.2-1ubuntu0.1_ powerpc.deb


• Ubuntu libhx-doc_3.2-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-doc_3.2-1ubuntu0.1_ powerpc.deb


• Ubuntu libhx22_3.2-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx22_3.2-1ubuntu0.1_po werpc.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu libhx-dev_1.28-1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-dev_1.28- 1ubuntu0.1_i386.deb


• Ubuntu libhx14_1.28-1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx14_1.28-1u buntu0.1_i386.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu libhx-dev_1.28-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_1.28-1ubuntu0.1 _lpia.deb


• Ubuntu libhx14_1.28-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx14_1.28-1ubuntu0.1_l pia.deb

Mandriva Linux Mandrake 2010.1

• Mandriva libHX-devel-3.4-1.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libHX22-3.4-1.1mdv2010.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu libhx-dev_2.9-3ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-dev_2.9-3 ubuntu0.1_i386.deb


• Ubuntu libhx-doc_2.9-3ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-doc_2.9-3 ubuntu0.1_i386.deb


• Ubuntu libhx18_2.9-3ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx18_2.9-3ub untu0.1_i386.deb

Mandriva Linux Mandrake 2009.0

• Mandriva libHX-devel-1.25-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libHX14-1.25-1.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.04 amd64

• Ubuntu libhx-dev_3.2-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-dev_3.2-1 ubuntu0.1_amd64.deb


• Ubuntu libhx-doc_3.2-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-doc_3.2-1 ubuntu0.1_amd64.deb


• Ubuntu libhx22_3.2-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx22_3.2-1ub untu0.1_amd64.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu libhx-dev_2.9-3ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-dev_2.9-3 ubuntu0.1_amd64.deb


• Ubuntu libhx-doc_2.9-3ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-doc_2.9-3 ubuntu0.1_amd64.deb


• Ubuntu libhx18_2.9-3ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx18_2.9-3ub untu0.1_amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu libhx-dev_1.10.2-2ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-dev_1.10. 2-2ubuntu0.1_i386.deb


• Ubuntu libhx10_1.10.2-2ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx10_1.10.2- 2ubuntu0.1_i386.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva lib64HX-devel-1.25-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64HX14-1.25-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu libhx-dev_1.28-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-dev_1.28- 1ubuntu0.1_amd64.deb


• Ubuntu libhx14_1.28-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx14_1.28-1u buntu0.1_amd64.deb

Ubuntu Ubuntu Linux 10.04 sparc

• Ubuntu libhx-dev_3.2-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-dev_3.2-1ubuntu0.1_ sparc.deb


• Ubuntu libhx-doc_3.2-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx-doc_3.2-1ubuntu0.1_ sparc.deb


• Ubuntu libhx22_3.2-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/libh/libhx/libhx22_3.2-1ubuntu0.1_sp arc.deb

Mandriva Linux Mandrake 2009.1

• Mandriva libHX-devel-2.5-1.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libHX18-2.5-1.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 10.04 i386

• Ubuntu libhx-dev_3.2-1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-dev_3.2-1 ubuntu0.1_i386.deb


• Ubuntu libhx-doc_3.2-1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx-doc_3.2-1 ubuntu0.1_i386.deb


• Ubuntu libhx22_3.2-1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/libh/libhx/libhx22_3.2-1ub untu0.1_i386.deb

libHX 'HX_split()' Remote Heap-Based Buffer Overflow Vulnerability

References:

• string: fixed buffer overflow in HX_split when too few fields are present (libHX)
  
• CVE Request: heap-based buffer overflow in libHX (Thomas Biege)
  
• CVE-2010-2947: LibHX Heap Based Buffer Overflow (xorl)
  
• libHX Homepage (libHX)