Coreutils DIR Width Argument Integer Overflow Vulnerability

Bugtraq ID:	9793
Class:	Boundary Condition Error
CVE:
Remote:	Unknown
Local:	Yes
Published:	Mar 02 2004 12:00AM
Updated:	Mar 02 2004 12:00AM
Credit:	Disclosure of this issue is credited to Shaun Colley <[email protected]>.
Vulnerable:	GNU fileutils 4.1.11 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Corporate Server 2.1 + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 9.0 GNU fileutils 4.1.9 + Redhat Linux 8.0 GNU fileutils 4.1.7 GNU fileutils 4.1.6 + Sun Linux 5.0.6 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 GNU fileutils 4.1.5 + MandrakeSoft Multi Network Firewall 2.0 GNU fileutils 4.1.1 + Turbolinux Turbolinux Desktop 10.0 GNU fileutils 4.1 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + Caldera OpenLinux Workstation 3.1 + Debian Linux 3.0 sparc + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 + Debian Linux 3.0 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 + Redhat Linux 7.3 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 alpha + Redhat Linux 7.2 alpha + Redhat Linux 7.2 + Redhat Linux 7.2 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.0 sparc + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Slackware Linux 8.0 + Slackware Linux 8.0 + Sun Cobalt Qube 3 + Sun Cobalt Qube 3 + Sun Cobalt RaQ 4 + Sun Cobalt RaQ 4 + Sun Cobalt RaQ 550 + Sun Cobalt RaQ 550 + Sun Cobalt RaQ XTR + Sun Cobalt RaQ XTR + Sun Linux 5.0.7 + Sun Linux 5.0.6 + Sun Linux 5.0.6 + Sun Linux 5.0.5 + Sun Linux 5.0.5 + Sun Linux 5.0.3 + Sun Linux 5.0.3 + Sun Linux 5.0 + Sun Linux 5.0 + Sun LX50 + Sun LX50 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 i386 + SuSE Linux 7.2 i386 + SuSE Linux 7.2 i386 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.1 alpha + SuSE Linux 7.0 sparc + SuSE Linux 7.0 sparc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 ppc + SuSE Linux 7.0 i386 + SuSE Linux 7.0 i386 + SuSE Linux 7.0 alpha + SuSE Linux 7.0 alpha + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 + Trustix Secure Linux 1.1 GNU fileutils 4.0.36 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 + Redhat Linux 7.1 + Redhat Linux for iSeries 7.1 + Redhat Linux for iSeries 7.1 + Redhat Linux for pSeries 7.1 GNU fileutils 4.0.33 + Trend Micro InterScan VirusWall for Unix 6.0.5 + Turbolinux Turbolinux 6.0.5 + Turbolinux Turbolinux 6.0.5 + Turbolinux Turbolinux Advanced Server 6.0 + Turbolinux Turbolinux Advanced Server 6.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Server 6.1 + Turbolinux Turbolinux Server 6.1 + Turbolinux Turbolinux Workstation 8.0 + Turbolinux Turbolinux Workstation 8.0 + Turbolinux Turbolinux Workstation 7.0 + Turbolinux Turbolinux Workstation 7.0 + Turbolinux Turbolinux Workstation 6.0 GNU fileutils 4.0 + Debian Linux 2.2 sparc + Debian Linux 2.2 sparc + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 powerpc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 IA-32 + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 arm + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 alpha + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2 68k + Debian Linux 2.2 68k + Immunix Immunix OS 7+ + Redhat Linux 7.0 i386 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 + Redhat Linux 7.0 + Redhat Linux 7.0 + Redhat Linux 6.2 i386 + Redhat Linux 6.2 i386 + Redhat Linux 6.2 i386 + Redhat Linux 6.2 + Redhat Linux 6.2 + Redhat Linux 6.2 + Slackware Linux 7.1 + Slackware Linux 7.1 + Slackware Linux 7.1 + Slackware Linux 7.0 + Slackware Linux 7.0 + Slackware Linux 7.0 GNU Coreutils 5.1.3 GNU Coreutils 5.1.2 GNU Coreutils 5.1.1 GNU Coreutils 5.1 GNU Coreutils 5.0.91 GNU Coreutils 5.0.90 GNU Coreutils 5.0.1 GNU Coreutils 5.0 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Mandriva Linux Mandrake 9.2 GNU Coreutils 4.5.12 GNU Coreutils 4.5.11 GNU Coreutils 4.5.10 GNU Coreutils 4.5.9 GNU Coreutils 4.5.8 GNU Coreutils 4.5.7 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + Mandriva Linux Mandrake 9.1 GNU Coreutils 4.5.6 GNU Coreutils 4.5.5 GNU Coreutils 4.5.4 GNU Coreutils 4.5.3 + Redhat Linux 9.0 i386 GNU Coreutils 4.5.2 GNU Coreutils 4.5.2 GNU Coreutils 4.5.1
Not Vulnerable:

Coreutils DIR Width Argument Integer Overflow Vulnerability

Coreutils 'dir' has been reported prone to an integer overflow vulnerability. The issue reportedly presents itself when handling large integer value '-w' (width) command line arguments passed to the vulnerable application.

Due to the nature of this issue it may possibly be leveraged to deny service to applications that use the 'dir' utility. It has been conjectured that when invoked by an application with a malicious integer value passed via the '-w' argument, the affected application may hang while waiting for the utility to return output.

Coreutils DIR Width Argument Integer Overflow Vulnerability

No exploit is required to leverage this issue. The following proof of concept was provided:

bash$ dir -w 1073741828

Coreutils DIR Width Argument Integer Overflow Vulnerability

Solution:
GNU Core Utilities version 5.2.0 has been released dealing with this issue.


GNU Coreutils 4.5.1

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.10

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.11

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.12

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.2

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.2

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.3

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.4

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.5

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.6

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.7

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.8

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 4.5.9

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 5.0

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 5.0.1

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 5.0.90

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 5.0.91

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 5.1

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 5.1.1

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 5.1.2

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

GNU Coreutils 5.1.3

• GNU coreutils-5.2.0.tar.gz
  http://ftp.gnu.org/pub/gnu/coreutils/coreutils-5.2.0.tar.gz

Coreutils DIR Width Argument Integer Overflow Vulnerability

References:

• Coreutils Homepage (GNU)
  
• Coreutils 'dir' integer overflow vulnerability. (Shaun Colley )