Libksba 'ksba_oid_to_str() Function Buffer Overflow Vulnerability
BID:71285
Info
Libksba 'ksba_oid_to_str() Function Buffer Overflow Vulnerability
| Bugtraq ID: | 71285 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2014-9087 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 25 2014 12:00AM |
| Updated: | Apr 13 2015 09:30PM |
| Credit: | Hanno Böck |
| Vulnerable: |
Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Libksba Libksba 1.3.1 Libksba Libksba 1.3.0 Gnupg Gnupg 2.0.24 Gnupg Gnupg 2.0.23 Gnupg Gnupg 2.0.22 Gnupg Gnupg 2.0.21 Gnupg Gnupg 2.0.17 Gnupg Gnupg 2.0.16 Gnupg Gnupg 2.0.15 Gnupg Gnupg 2.0.14 Gnupg Gnupg 2.0.13 Gnupg Gnupg 2.0.11 Gnupg Gnupg 2.0.10 Gnupg Gnupg 2.0.8 Gnupg Gnupg 2.0.7 Gnupg Gnupg 2.0.6 Gnupg Gnupg 2.0.5 Gnupg Gnupg 2.0.20 Gnupg Gnupg 2.0.19 Gnupg Gnupg 2.0.18 Gnupg Gnupg 2.0.12 Gnupg Gnupg 2.0.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Libksba Libksba 1.3.2 |
Discussion
Libksba 'ksba_oid_to_str() Function Buffer Overflow Vulnerability
Libksba is prone to a buffer-overflow vulnerability because it fails to adequate boundary checks on user-supplied input.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Versions prior to Libksba 1.3.2 are vulnerable.
Libksba is prone to a buffer-overflow vulnerability because it fails to adequate boundary checks on user-supplied input.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Versions prior to Libksba 1.3.2 are vulnerable.
Exploit / POC
Libksba 'ksba_oid_to_str() Function Buffer Overflow Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Libksba 'ksba_oid_to_str() Function Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
-
Mandriva lib64ksba-devel-1.3.2-1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64ksba8-1.3.2-1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/
References
Libksba 'ksba_oid_to_str() Function Buffer Overflow Vulnerability
References:
References:
- [Announce] [security fix] Libksba 1.3.2 for GnuPG released (GnuPG)
- Fix buffer overflow in ksba_oid_to_str. (Libksba)
- Libksba Home Page (Libksba)