GNU Coreutils 'uniq' Text Utility Buffer Overflow Vulnerability

Bugtraq ID:	57517
Class:	Boundary Condition Error
CVE:	CVE-2013-0222
Remote:	No
Local:	Yes
Published:	Jan 21 2013 12:00AM
Updated:	Apr 13 2015 09:44PM
Credit:	Unknown
Vulnerable:	Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop 6 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 GNU Coreutils 8.6 Avaya one-X Client Enablement Services 6.2 Avaya one-X Client Enablement Services 6.1.2 Avaya one-X Client Enablement Services 6.1.1 Avaya one-X Client Enablement Services 6.1 Avaya one-X Client Enablement Services 6.0 Avaya one-X Client Enablement Service 6.1 SP3 Avaya one-X Client Enablement Service 6.1 SP2 Avaya one-X Client Enablement Service 6.1 Sp1 Avaya one-X Client Enablement Service 6.1 Avaya one-X Client Enablement Service 6.0 SP3 Avaya one-X Client Enablement Service 6.0 SP2 Avaya one-X Client Enablement Service 6.0 SP1 Avaya IP Office Server Edition 9.0 Avaya IP Office Server Edition 8.1 Avaya IP Office Application Server 9.0 Avaya Call Management System R17.0 Avaya Aura Session Manager 6.3.1 Avaya Aura Session Manager 6.2.1 Avaya Aura Session Manager 6.1.5 Avaya Aura Session Manager 6.1.3 Avaya Aura Session Manager 6.1.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.0.1 Avaya Aura Session Manager 6.3 Avaya Aura Session Manager 6.2.3 Avaya Aura Session Manager 6.2.2 Avaya Aura Session Manager 6.2 SP1 Avaya Aura Session Manager 6.2 Avaya Aura Session Manager 6.1 SP2 Avaya Aura Session Manager 6.1 Sp1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0.2 Avaya Aura Session Manager 6.0 SP1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2.4 Avaya Aura Session Manager 5.2.1 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 5.0 Avaya Aura Experience Portal 6.0.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Collaboration Environment 2.0
Not Vulnerable:

GNU Coreutils 'uniq' Text Utility Buffer Overflow Vulnerability

GNU Coreutils is prone to a buffer-overflow vulnerability because it fails to properly bounds check user-supplied input.

A local attacker can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code-execution may be possible; however this has not been confirmed.

GNU Coreutils 'uniq' Text Utility Buffer Overflow Vulnerability

The following proof-of-concept is available:

% perl -e 'print "1","\0"x50000000,"\r\n\r\n"' | uniq
[2] 8244 done perl -e 'print "1","\0"x50000000,"\r\n\r\n"' |
8245 segmentation fault uniq

GNU Coreutils 'uniq' Text Utility Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Enterprise Server 5 x86_64

• Mandriva coreutils-6.12-2.6mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva coreutils-doc-6.12-2.6mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva coreutils-6.12-2.6mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva coreutils-doc-6.12-2.6mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Business Server 1 X86 64

• Mandriva coreutils-8.15-3.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva coreutils-doc-8.15-3.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/

GNU Coreutils 'uniq' Text Utility Buffer Overflow Vulnerability

References:

• Bug 796243 - VUL-1: coreutils: segmentation fault in 'uniq' with long line input (Novell)
  
• Coreutils Homepage (GNU)
  
• CVE Request coreutils (SecLists.Org)
  
• File coreutils-8.6-i18n.patch of Package coreutils (OpenSuse)
  
• Request 149348 (review) (OpenSuse)
  
• coreutils security, bug fix, and enhancement update (RHSA-2013-1652) (Avaya)