file - CVE-2007-2799: incorrect patch for CVE-2007-1536

Debian Bug report logs - #428293
file - CVE-2007-2799: incorrect patch for CVE-2007-1536

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Bastian Blank <waldi@debian.org>

To: submit@bugs.debian.org

Subject: file - CVE-2007-2799: incorrect patch for CVE-2007-1536

Date: Sun, 10 Jun 2007 16:02:20 +0200

[Message part 1 (text/plain, inline)]

Package: file
Version: 4.21-1
Severity: serious
Tags: security

| Integer overflow in the "file" program 4.20, when running on 32-bit
| systems, might allow user-assisted attackers to execute arbitrary code
| via a large file that triggers an overflow that bypasses an assert()
| statement. NOTE: this issue is due to an incorrect patch for
| CVE-2007-1536.

Bastian

-- 
Each kiss is as the first.
		-- Miramanee, Kirk's wife, "The Paradise Syndrome",
		   stardate 4842.6

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 428293@bugs.debian.org (full text, mbox, reply):

From: Daniel Baumann <daniel@debian.org>

To: 428293@bugs.debian.org

Cc: waldi@debian.org

Subject: Re: Bug#428293: file - CVE-2007-2799: incorrect patch for CVE-2007-1536

Date: Sun, 10 Jun 2007 15:11:10 +0000 (UTC)

> Integer overflow in the "file" program 4.20, when running on 32-bit
> systems, might allow user-assisted attackers to execute arbitrary code
> via a large file that triggers an overflow that bypasses an assert()
> statement. NOTE: this issue is due to an incorrect patch for
> CVE-2007-1536.

As file 4.21 is not affected, only sarge and needs an update. Sending the proposed package to the security team now.

Regards,
Daniel

Message #15 received at 428293@bugs.debian.org (full text, mbox, reply):

From: Touko Korpela <tkorpela@phnet.fi>

To: Debian Bug Tracking System <428293@bugs.debian.org>

Subject: file: DoS in 4.21-1

Date: Mon, 11 Jun 2007 16:43:22 +0300

Package: file
Version: 4.21-1
Followup-For: Bug #428293

Different issue, but here is information about DoS bug:
http://www.amavis.org/security/asa-2007-3.txt

-quote begin-
To check, if this issue has been properly fixed, please do
the following steps:

$ perl -e 'for (1..2700) {print "\n" x 10}' >0.lis
$ file 0.lis

The output
"0.lis: ASCII text"
must appear immediately, without creating a huge CPU load.
-quote end-

-- System Information:
Debian Release: lenny/sid
  APT prefers testing
  APT policy: (900, 'testing'), (900, 'stable'), (700, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.18-4-k7 (SMP w/1 CPU core)
Locale: LANG=fi_FI.UTF-8, LC_CTYPE=fi_FI.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages file depends on:
ii  libc6                         2.5-10     GNU C Library: Shared libraries
ii  libmagic1                     4.21-1     File type determination library us

file recommends no packages.

-- no debconf information

Message #20 received at 428293@bugs.debian.org (full text, mbox, reply):

From: Daniel Baumann <daniel@debian.org>

To: 428293@bugs.debian.org, control@bugs.debian.org

Date: Tue, 12 Jun 2007 13:21:14 +0200

tags 428293 +etch
thanks

> As file 4.21 is not affected, only sarge and needs an update. Sending
> the proposed package to the security team now.

s/sarge/etch/

-- 
Address:        Daniel Baumann, Burgunderstrasse 3, CH-4562 Biberist
Email:          daniel.baumann@panthera-systems.net
Internet:       http://people.panthera-systems.net/~daniel-baumann/

Message #27 received at 428293@bugs.debian.org (full text, mbox, reply):

From: Touko Korpela <tkorpela@phnet.fi>

To: 428293@bugs.debian.org

Subject: status?

Date: Mon, 2 Jul 2007 15:49:21 +0300

found 428293 4.17-5etch4
thanks

What's status of this bug?
DoS in 4.21-1 is still there too.

Message #34 received at 428293@bugs.debian.org (full text, mbox, reply):

From: Kurt Roeckx <kurt@roeckx.be>

To: Daniel Baumann <daniel@debian.org>, 428293@bugs.debian.org

Cc: waldi@debian.org

Subject: Re: Bug#428293: file - CVE-2007-2799: incorrect patch for CVE-2007-1536

Date: Wed, 18 Jul 2007 23:17:44 +0200

On Sun, Jun 10, 2007 at 03:11:10PM +0000, Daniel Baumann wrote:
> > Integer overflow in the "file" program 4.20, when running on 32-bit
> > systems, might allow user-assisted attackers to execute arbitrary code
> > via a large file that triggers an overflow that bypasses an assert()
> > statement. NOTE: this issue is due to an incorrect patch for
> > CVE-2007-1536.
> 
> As file 4.21 is not affected, only sarge and needs an update. Sending the proposed package to the security team now.

This bug was filed against version 4.21-1 (which is in
testing/unstable), but it marked as only affecting etch.

I guess the 4.21-1 should be removed from the found version 
list, and added to the fixed list?  (And the etch tag can then
also be removed.)


Kurt

Message #39 received at 428293@bugs.debian.org (full text, mbox, reply):

From: kurt@roeckx.be (Kurt Roeckx)

To: control@bugs.debian.org

Cc: 428293@bugs.debian.org

Subject: tagging 428293

Date: Mon, 23 Jul 2007 00:25:36 +0200 (CEST)

# Automatically generated email from bts, devscripts version 2.9.6
# Someone mentioned that 4.21-1 has the problem too, so removing tag.  Please fix the version information if it's wrong.
tags 428293 - etch

Message #46 received at 428293@bugs.debian.org (full text, mbox, reply):

From: Touko Korpela <tkorpela@phnet.fi>

To: 428293@bugs.debian.org

Cc: team@security.debian.org

Subject: Time for security upload?

Date: Mon, 30 Jul 2007 20:28:00 +0300

Could security team look at this and make upload for stable (and perhaps 
oldstable)?
DoS in unstable is still there too, but that's perhaps different issue.

Message #55 received at 428293-done@bugs.debian.org (full text, mbox, reply):

From: Daniel Baumann <daniel@debian.org>

To: 428293-done@bugs.debian.org

Subject: Re: file - CVE-2007-2799: incorrect patch for CVE-2007-1536

Date: Tue, 14 Aug 2007 22:54:40 +0200

This bug has been fixed everywhere, hence closing it.

-- 
Address:        Daniel Baumann, Burgunderstrasse 3, CH-4562 Biberist
Email:          daniel.baumann@panthera-systems.net
Internet:       http://people.panthera-systems.net/~daniel-baumann/

Send a report that this bug log contains spam.