CVE-2012-3404 CVE-2012-3405

Debian Bug report logs - #681473
CVE-2012-3404 CVE-2012-3405

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <muehlenhoff@univention.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2012-3404 CVE-2012-3405 CVE-2012-3406

Date: Fri, 13 Jul 2012 15:41:23 +0200

Package: eglibc
Severity: important
Tags: security

Hi,
please see http://www.openwall.com/lists/oss-security/2012/07/11/17 for details
and references to upstream patches.

The security impact is rather low IMO; if the format strings are under control
of a attacker, this opens a whole can of worms anyway.

Still, it would be nice to get these fixed for Wheezy and for Squeeze in a point
update.

Cheers,
        Moritz

Message #16 received at 681473@bugs.debian.org (full text, mbox, reply):

From: Aurelien Jarno <aurelien@aurel32.net>

To: Moritz Muehlenhoff <muehlenhoff@univention.de>, 681473@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#681473: CVE-2012-3404 CVE-2012-3405 CVE-2012-3406

Date: Tue, 17 Jul 2012 16:01:40 +0200

clone 681473 -1
retitle 681473 CVE-2012-3404 CVE-2012-3405
retitle -1 CVE-2012-3406
thanks

On Fri, Jul 13, 2012 at 03:41:23PM +0200, Moritz Muehlenhoff wrote:
> Package: eglibc
> Severity: important
> Tags: security
> 
> Hi,
> please see http://www.openwall.com/lists/oss-security/2012/07/11/17 for details
> and references to upstream patches.
> 
> The security impact is rather low IMO; if the format strings are under control
> of a attacker, this opens a whole can of worms anyway.
> 
> Still, it would be nice to get these fixed for Wheezy and for Squeeze in a point
> update.
> 

I'll add the patches for CVE-2012-3404 and CVE-2012-3405 as they come
from upstream and look correct. For CVE-2012-3406 RedHat, as usual, 
hasn't submitted the patch upstream and thus it hasn't been reviewed. I
have looked at it quickly and I have to say I don't really like it. 
Replacing a call to alloca() by a call to malloc() without checking the
return value is only a small improvement when the attacker can control
the allocation size. Also it means the attacker can DoS the system or 
crash the program. To finish malloc() + memmove() + free() is not the 
best way to reallocate big chunks of memory when realloc() exists.

I am therefore not planning to apply this patch in the current state,
and thus I am cloning this bug to keep this CVE entry separated from the
others.

-- 
Aurelien Jarno                          GPG: 1024D/F1BCDB73
aurelien@aurel32.net                 http://www.aurel32.net

Message #21 received at 681473-close@bugs.debian.org (full text, mbox, reply):

From: Aurelien Jarno <aurel32@debian.org>

To: 681473-close@bugs.debian.org

Subject: Bug#681473: fixed in eglibc 2.13-35

Date: Sun, 22 Jul 2012 18:47:20 +0000

Source: eglibc
Source-Version: 2.13-35

We believe that the bug you reported is fixed in the latest version of
eglibc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 681473@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno <aurel32@debian.org> (supplier of updated eglibc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 22 Jul 2012 17:36:20 +0200
Source: eglibc
Binary: libc-bin libc-dev-bin glibc-doc eglibc-source locales locales-all nscd multiarch-support libc6 libc6-dev libc6-dbg libc6-prof libc6-pic libc6-udeb libc6.1 libc6.1-dev libc6.1-dbg libc6.1-prof libc6.1-pic libc6.1-udeb libc0.3 libc0.3-dev libc0.3-dbg libc0.3-prof libc0.3-pic libc0.3-udeb libc0.1 libc0.1-dev libc0.1-dbg libc0.1-prof libc0.1-pic libc0.1-udeb libc6-i386 libc6-dev-i386 libc6-sparc64 libc6-dev-sparc64 libc6-s390 libc6-dev-s390 libc6-s390x libc6-dev-s390x libc6-amd64 libc6-dev-amd64 libc6-powerpc libc6-dev-powerpc libc6-ppc64 libc6-dev-ppc64 libc6-mipsn32 libc6-dev-mipsn32 libc6-mips64 libc6-dev-mips64 libc0.1-i386 libc0.1-dev-i386 libc6-i686 libc6-xen libc0.1-i686 libc0.3-i686 libc0.3-xen libc6.1-alphaev67 libc6-loongson2f libnss-dns-udeb libnss-files-udeb
Architecture: source all amd64
Version: 2.13-35
Distribution: unstable
Urgency: low
Maintainer: Aurelien Jarno <aurel32@debian.org>
Changed-By: Aurelien Jarno <aurel32@debian.org>
Description: 
 eglibc-source - Embedded GNU C Library: sources
 glibc-doc  - Embedded GNU C Library: Documentation
 libc-bin   - Embedded GNU C Library: Binaries
 libc-dev-bin - Embedded GNU C Library: Development binaries
 libc0.1    - Embedded GNU C Library: Shared libraries
 libc0.1-dbg - Embedded GNU C Library: detached debugging symbols
 libc0.1-dev - Embedded GNU C Library: Development Libraries and Header Files
 libc0.1-dev-i386 - Embedded GNU C Library: 32bit development libraries for AMD64
 libc0.1-i386 - Embedded GNU C Library: 32bit shared libraries for AMD64
 libc0.1-i686 - Embedded GNU C Library: Shared libraries [i686 optimized]
 libc0.1-pic - Embedded GNU C Library: PIC archive library
 libc0.1-prof - Embedded GNU C Library: Profiling Libraries
 libc0.1-udeb - Embedded GNU C Library: Shared libraries - udeb (udeb)
 libc0.3    - Embedded GNU C Library: Shared libraries
 libc0.3-dbg - Embedded GNU C Library: detached debugging symbols
 libc0.3-dev - Embedded GNU C Library: Development Libraries and Header Files
 libc0.3-i686 - Embedded GNU C Library: Shared libraries [i686 optimized]
 libc0.3-pic - Embedded GNU C Library: PIC archive library
 libc0.3-prof - Embedded GNU C Library: Profiling Libraries
 libc0.3-udeb - Embedded GNU C Library: Shared libraries - udeb (udeb)
 libc0.3-xen - Embedded GNU C Library: Shared libraries [Xen version]
 libc6      - Embedded GNU C Library: Shared libraries
 libc6-amd64 - Embedded GNU C Library: 64bit Shared libraries for AMD64
 libc6-dbg  - Embedded GNU C Library: detached debugging symbols
 libc6-dev  - Embedded GNU C Library: Development Libraries and Header Files
 libc6-dev-amd64 - Embedded GNU C Library: 64bit Development Libraries for AMD64
 libc6-dev-i386 - Embedded GNU C Library: 32-bit development libraries for AMD64
 libc6-dev-mips64 - Embedded GNU C Library: 64bit Development Libraries for MIPS64
 libc6-dev-mipsn32 - Embedded GNU C Library: n32 Development Libraries for MIPS64
 libc6-dev-powerpc - Embedded GNU C Library: 32bit powerpc development libraries for p
 libc6-dev-ppc64 - Embedded GNU C Library: 64bit Development Libraries for PowerPC64
 libc6-dev-s390 - Embedded GNU C Library: 32bit Development Libraries for IBM zSeri
 libc6-dev-s390x - Embedded GNU C Library: 64bit Development Libraries for IBM zSeri
 libc6-dev-sparc64 - Embedded GNU C Library: 64bit Development Libraries for UltraSPAR
 libc6-i386 - Embedded GNU C Library: 32-bit shared libraries for AMD64
 libc6-i686 - Embedded GNU C Library: Shared libraries [i686 optimized]
 libc6-loongson2f - Embedded GNU C Library: Shared libraries (Loongson 2F optimized)
 libc6-mips64 - Embedded GNU C Library: 64bit Shared libraries for MIPS64
 libc6-mipsn32 - Embedded GNU C Library: n32 Shared libraries for MIPS64
 libc6-pic  - Embedded GNU C Library: PIC archive library
 libc6-powerpc - Embedded GNU C Library: 32bit powerpc shared libraries for ppc64
 libc6-ppc64 - Embedded GNU C Library: 64bit Shared libraries for PowerPC64
 libc6-prof - Embedded GNU C Library: Profiling Libraries
 libc6-s390 - Embedded GNU C Library: 32bit Shared libraries for IBM zSeries
 libc6-s390x - Embedded GNU C Library: 64bit Shared libraries for IBM zSeries
 libc6-sparc64 - Embedded GNU C Library: 64bit Shared libraries for UltraSPARC
 libc6-udeb - Embedded GNU C Library: Shared libraries - udeb (udeb)
 libc6-xen  - Embedded GNU C Library: Shared libraries [Xen version]
 libc6.1    - Embedded GNU C Library: Shared libraries
 libc6.1-alphaev67 - Embedded GNU C Library: Shared libraries (EV67 optimized)
 libc6.1-dbg - Embedded GNU C Library: detached debugging symbols
 libc6.1-dev - Embedded GNU C Library: Development Libraries and Header Files
 libc6.1-pic - Embedded GNU C Library: PIC archive library
 libc6.1-prof - Embedded GNU C Library: Profiling Libraries
 libc6.1-udeb - Embedded GNU C Library: Shared libraries - udeb (udeb)
 libnss-dns-udeb - Embedded GNU C Library: NSS helper for DNS - udeb (udeb)
 libnss-files-udeb - Embedded GNU C Library: NSS helper for files - udeb (udeb)
 locales    - Embedded GNU C Library: National Language (locale) data [support]
 locales-all - Embedded GNU C Library: Precompiled locale data
 multiarch-support - Transitional package to ensure multiarch compatibility
 nscd       - Embedded GNU C Library: Name Service Cache Daemon
Closes: 681113 681473 681688 681708
Changes: 
 eglibc (2.13-35) unstable; urgency=low
 .
   [ Aurelien Jarno ]
   * patches/arm/unsubmitted-ldconfig-cache-abi.diff: disable, as it will
     conflict with upstream x32 support.
   * Update Czech debconf translation, by Miroslav Kure.  Closes: #681708.
   * local/manpages/ld.so.8: fix LD_VERBOSE description after manpage
     rework.  Closes: #681688.
   * patches/any/cvs-vfprintf-positional.diff: new patch from upstream to
     fix a stack corruption in vfprintf with positional parameters
     (CVE-2012-3404). patches/any/cvs-vfprintf-many-format-strings.diff: new
     patch from upstream to fix a FORTIFY_SOURCE format string protection
     bypass (CVE-2012-3405).  Closes: #681473.
 .
   [ Petr Salinger ]
   * fixup kfreebsd/local-use-thr-primitives.diff. Closes: #681113.
Checksums-Sha1: 
 eabaa0c8a6a90cdd01aadb433e13929aa7e75908 4681 eglibc_2.13-35.dsc
 d6a6c45115dee11f5b8a5d2d58673a9ff77b6919 1964153 eglibc_2.13-35.diff.gz
 3c957a740709c8ce91558ad9a4f3f8066e840c05 1895190 glibc-doc_2.13-35_all.deb
 32ef339e9b5c1b8a19bd2ed03031f0bb0b7a0bf7 13397424 eglibc-source_2.13-35_all.deb
 350125575896b7340cd7d4b9126ec8b0ebcf03ce 5711674 locales_2.13-35_all.deb
 d1300d7cc9b2fc1f160eeb29c4de5e7a7382ca66 4344584 libc6_2.13-35_amd64.deb
 3a7950bb9910bd41a8b400e86afa99f3ab69d77e 2650510 libc6-dev_2.13-35_amd64.deb
 ab988fb3d8ddf2d85cd8bbe88e5cb4bf0f3f4961 2092296 libc6-prof_2.13-35_amd64.deb
 6a8baa3ddd05ba9030e1697028df1d682d05725e 1596776 libc6-pic_2.13-35_amd64.deb
 b0e7ac04e006716f2a47c666616eea22abe41a7b 1266904 libc-bin_2.13-35_amd64.deb
 da86f6234d86e3e63669b80eeecdc1e8b29da15f 224580 libc-dev-bin_2.13-35_amd64.deb
 c4f80c540f2da08f13dfabe70bcf3c61d5875d74 148610 multiarch-support_2.13-35_amd64.deb
 b02620ca2080b0592e90ce97739cb3e89b15a846 3252080 locales-all_2.13-35_amd64.deb
 01f46a399cc52206f92becb770bacc920bbaad8f 4024184 libc6-i386_2.13-35_amd64.deb
 b7f891b6c3859edfcee7a30890c66db5183b3b02 1575184 libc6-dev-i386_2.13-35_amd64.deb
 088a613b53cdd0b12df6d0edd90cf29f964ef341 211372 nscd_2.13-35_amd64.deb
 24ed3a4e5625c3d0000ff2b04632d4c7c152cb5f 2573552 libc6-dbg_2.13-35_amd64.deb
 2622326bca43c42d1171f52f2072adcc9ceebe8d 935080 libc6-udeb_2.13-35_amd64.udeb
 1be356e71f52be45c8c234fe354a1b40ffb24963 10182 libnss-dns-udeb_2.13-35_amd64.udeb
 cf0c077d5d88ebc7f529fc0ecfc541e30b04705d 16042 libnss-files-udeb_2.13-35_amd64.udeb
Checksums-Sha256: 
 09e78487514e7ffda9f42f9ee62d166a26709c2f8bff3b9f5eafde261cb96637 4681 eglibc_2.13-35.dsc
 e3b274fcd2a2cf2d70d8116d3e49f33260380d2e3dc49861c088ab4a0dbcde3a 1964153 eglibc_2.13-35.diff.gz
 70b620d8fde9ad2d260368e31e3d3efd060d6b16e1d76ffc5da38afd64b90252 1895190 glibc-doc_2.13-35_all.deb
 f93ce84238e944cf08d558bafec0fcfb47240a55d2b31efa9e011223fa8364d7 13397424 eglibc-source_2.13-35_all.deb
 ff6770764b9e08297d6756729dcf92df5f5b622bcf069a93f2a3bda406078c63 5711674 locales_2.13-35_all.deb
 2f92a074a7f1d6fe223959ed765976ea1dc084684d996d2a5c6885ba36f13e4c 4344584 libc6_2.13-35_amd64.deb
 a7d2cd6d0ec285b30ea016540fe11f9d2977312883e31a29ab0dca468f251de9 2650510 libc6-dev_2.13-35_amd64.deb
 71d0016b0c3d54c661dfcb638cbda94ca46f02bdefd595cab30776de87f2cf83 2092296 libc6-prof_2.13-35_amd64.deb
 302c0c0ffa071500b4f747d86e09963a19d238ad996712b96ff2557ba6e5ca16 1596776 libc6-pic_2.13-35_amd64.deb
 e9aed43cfaf55394c8ec994506d84fce42ab197094924594347fc9575318504f 1266904 libc-bin_2.13-35_amd64.deb
 e54beb435f8f37cea1038eed0fc82613b8f00550013e931dd87169aca4b908e0 224580 libc-dev-bin_2.13-35_amd64.deb
 e2dde56e15708f71934cea151fb331217b1e324386bf2f4f5a19c0fc13b274e7 148610 multiarch-support_2.13-35_amd64.deb
 8dc5d78fb22c903c4f236089aaf484f9dc7d8d878ff0680a8c6a1a420ea56e13 3252080 locales-all_2.13-35_amd64.deb
 5c3a96e90939d818410485d3ec37a5181bce30d85964ee443fd4eabd4c7408be 4024184 libc6-i386_2.13-35_amd64.deb
 90fb1847b5ac8c0404c6b7d9f82fb17b6707e62548c42597a7ed1d8d459ce048 1575184 libc6-dev-i386_2.13-35_amd64.deb
 7bba3aa9fba5338b68453b9c59c738e7d3f0702108d977da75839d8c64f90521 211372 nscd_2.13-35_amd64.deb
 2bf18f775840ce0d7322af934251b54883891290bc806f3e18e84b9618914f3d 2573552 libc6-dbg_2.13-35_amd64.deb
 aa9e6f59403541d6087e644817b4f57f368aa53d83560ca35c90235ffd153b47 935080 libc6-udeb_2.13-35_amd64.udeb
 cfd3ea3598924744ade80a1253668cd8cb137276fa2d90e316ff1af9942373db 10182 libnss-dns-udeb_2.13-35_amd64.udeb
 82b45f28a3e6b61e5f859e119964d7ac3b2465fc72eb6c76696ce11421d86a84 16042 libnss-files-udeb_2.13-35_amd64.udeb
Files: 
 4da8e36d2fe1f535d65f76fb2a16f863 4681 libs required eglibc_2.13-35.dsc
 7cf6e94f6a0559e2e4560509dda0e03f 1964153 libs required eglibc_2.13-35.diff.gz
 9d63d3af2adeedbe764a5dc886f745bc 1895190 doc optional glibc-doc_2.13-35_all.deb
 3d28e128b5cac4c2ce7b6eb13a4a5609 13397424 devel optional eglibc-source_2.13-35_all.deb
 3324df9671b283827d7ea1244464d8f6 5711674 localization standard locales_2.13-35_all.deb
 e8d55272e6dd54ffd99bbf3dcd00fbb1 4344584 libs required libc6_2.13-35_amd64.deb
 69dcfd31044f16997d7bfba02925bd7c 2650510 libdevel optional libc6-dev_2.13-35_amd64.deb
 01f842fc6c29f0eca23e543426b0546e 2092296 libdevel extra libc6-prof_2.13-35_amd64.deb
 bf5594238fd2c02c292d60ac5b1687aa 1596776 libdevel optional libc6-pic_2.13-35_amd64.deb
 fa2b59518151769e16c7eb84e2ae9667 1266904 libs required libc-bin_2.13-35_amd64.deb
 caf9a3e0ee99c597ec6042a29aef0a6c 224580 libdevel optional libc-dev-bin_2.13-35_amd64.deb
 a98606574b6d5baefdfdc56d2e71874f 148610 libs required multiarch-support_2.13-35_amd64.deb
 7c5f8a724509491df8eb3ae7a5b9aa5a 3252080 localization extra locales-all_2.13-35_amd64.deb
 342159658ed75c9ab226a3a7463110a3 4024184 libs optional libc6-i386_2.13-35_amd64.deb
 cf965c529e0cee987ef9abd7b4137bab 1575184 libdevel optional libc6-dev-i386_2.13-35_amd64.deb
 32e4aaaf39f0f9e2225923185ffb9edc 211372 admin optional nscd_2.13-35_amd64.deb
 db68d93b0d6d2e508f3f0ff0db5444d4 2573552 debug extra libc6-dbg_2.13-35_amd64.deb
 6e1632b585d7bcbb40067a432730ccfe 935080 debian-installer extra libc6-udeb_2.13-35_amd64.udeb
 d0f94594dd25d8f850eb56e3299991af 10182 debian-installer extra libnss-dns-udeb_2.13-35_amd64.udeb
 c91d988ff724381a915fd51b276f2f50 16042 debian-installer extra libnss-files-udeb_2.13-35_amd64.udeb
Package-Type: udeb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFQDEA8w3ao2vG823MRAiahAJ9vCgJnKkXzeHGZmpUd+V0hzQrJggCdE4V/
hWZrDL5NEFhFtBkhVEhiBws=
=RL+0
-----END PGP SIGNATURE-----

Message #26 received at 681473@bugs.debian.org (full text, mbox, reply):

From: Jonathan Wiltshire <jmw@debian.org>

To: 681473@bugs.debian.org

Subject: Re: CVE-2012-3404 CVE-2012-3405

Date: Mon, 23 Jul 2012 11:15:02 -0000

Dear maintainer,

Recently you fixed one or more security problems and as a result you closed
this bug. These problems were not serious enough for a Debian Security
Advisory, so they are now on my radar for fixing in the following suites
through point releases:

squeeze (6.0.6) - use target "stable"

Please prepare a minimal-changes upload targetting each of these suites,
and submit a debdiff to the Release Team [0] for consideration. They will
offer additional guidance or instruct you to upload your package.

I will happily assist you at any stage if the patch is straightforward and
you need help. Please keep me in CC at all times so I can
track [1] the progress of this request.

For details of this process and the rationale, please see the original
announcement [2] and my blog post [3].

0: debian-release@lists.debian.org
1: http://prsc.debian.net/tracker/681473/
2: <201101232332.11736.thijs@debian.org>
3: http://deb.li/prsc

Thanks,

with his security hat on:
--
Jonathan Wiltshire                                      jmw@debian.org
Debian Developer                         http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51

Message #31 received at 681473@bugs.debian.org (full text, mbox, reply):

From: Aurelien Jarno <aurelien@aurel32.net>

To: Jonathan Wiltshire <jmw@debian.org>, 681473@bugs.debian.org

Subject: Re: Bug#681473: CVE-2012-3404 CVE-2012-3405

Date: Mon, 23 Jul 2012 17:46:04 +0200

Le 23/07/2012 13:15, Jonathan Wiltshire a écrit :
> Dear maintainer,
> 
> Recently you fixed one or more security problems and as a result you closed
> this bug. These problems were not serious enough for a Debian Security
> Advisory, so they are now on my radar for fixing in the following suites
> through point releases:
> 
> squeeze (6.0.6) - use target "stable"
> 
> Please prepare a minimal-changes upload targetting each of these suites,
> and submit a debdiff to the Release Team [0] for consideration. They will
> offer additional guidance or instruct you to upload your package.
> 

The patches have been committed to the stable branch of the SVN at the
same time than in the unstable branch. I'll do the upload when a bit
more things are accumulated or a bit before the deadline for 6.0.6.

-- 
Aurelien Jarno                          GPG: 1024D/F1BCDB73
aurelien@aurel32.net                 http://www.aurel32.net

Send a report that this bug log contains spam.