CVE-2012-5667: buffer overflow with overly long input lines

Debian Bug report logs - #701897
CVE-2012-5667: buffer overflow with overly long input lines

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <geissert@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2012-5667: buffer overflow with overly long input lines

Date: Thu, 28 Feb 2013 16:55:40 +0100

Package: grep
Severity: grave
Version: 2.6.3-3
Tags: security
X-Debbugs-CC: secure-testing-team@lists.alioth.debian.org

Hi,
the following vulnerability was published for grep.

CVE-2012-5667[0]:
| Multiple integer overflows in GNU Grep before 2.11 might allow
| context-dependent attackers to execute arbitrary code via vectors
| involving a long input line that triggers a heap-based buffer
| overflow.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5667
    http://security-tracker.debian.org/tracker/CVE-2012-5667
Please adjust the affected versions in the BTS as needed.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

Message #12 received at 701897@bugs.debian.org (full text, mbox, reply):

From: Gianluca Ciccarelli <galiziacentrale@gmail.com>

To: 701897@bugs.debian.org

Subject: CVE-2012-5667: buffer overflow with overly long input lines

Date: Thu, 28 Feb 2013 21:56:12 +0100

[Message part 1 (text/plain, inline)]

tags 701897 squeeze unreproducible
--

I have tried the PoC proposed by the original reported, but
have different outcomes:
- On a running squeeze distribution, nothing happens. No
  segfaults, in particular.
- On a wheezy machine, I downloaded version 2.6.3's .dsc
  from the QA page's link, configured, and built it; When I
  run the PoC, I get:
    grep: memory exhausted
  which is the same result that I get when I use the version
  installed on the machine.

The notes on the Debian Security Tracker, however, suggest
that the segfault is reproducible. It would be interesting
to know other voices on this.

I tag the issue with `squeeze' because it is the only
possibly vulnerable version (<2.11).

-- 
Gianluca Ciccarelli
GPG key ID: 0x39BBDB6C

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 701897@bugs.debian.org (full text, mbox, reply):

From: Julien Cristau <jcristau@debian.org>

To: Gianluca Ciccarelli <galiziacentrale@gmail.com>, 701897@bugs.debian.org

Subject: Re: Bug#701897: CVE-2012-5667: buffer overflow with overly long input lines

Date: Thu, 28 Feb 2013 22:56:08 +0100

[Message part 1 (text/plain, inline)]

On Thu, Feb 28, 2013 at 21:56:12 +0100, Gianluca Ciccarelli wrote:

> I tag the issue with `squeeze' because it is the only
> possibly vulnerable version (<2.11).
> 
Please don't do that.  That's not what the suite tags are for, version
tracking does that job (I removed the tag).

Cheers,
Julien

[signature.asc (application/pgp-signature, inline)]

Message #26 received at 701897@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <geissert@debian.org>

To: 701897@bugs.debian.org

Cc: Gianluca Ciccarelli <galiziacentrale@gmail.com>

Subject: Re: Bug#701897: CVE-2012-5667: buffer overflow with overly long input lines

Date: Mon, 4 Mar 2013 11:29:29 +0100

Hi,

The issue can easily be reproduced on an x86_64 system running squeeze
with the public reproducer.
Valgrind also shows the issue (but beware of the time and memory it takes).

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

Message #33 received at 701897-close@bugs.debian.org (full text, mbox, reply):

From: Santiago Ruano Rincón <santiago@debian.org>

To: 701897-close@bugs.debian.org

Subject: Bug#701897: fixed in grep 2.6.3-3+squeeze1

Date: Sat, 10 Aug 2013 15:48:02 +0000

Source: grep
Source-Version: 2.6.3-3+squeeze1

We believe that the bug you reported is fixed in the latest version of
grep, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 701897@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Santiago Ruano Rincón <santiago@debian.org> (supplier of updated grep package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Thu, 25 Jul 2013 10:13:24 +0200
Source: grep
Binary: grep
Architecture: source amd64
Version: 2.6.3-3+squeeze1
Distribution: oldstable
Urgency: low
Maintainer: Anibal Monsalve Salazar <anibal@debian.org>
Changed-By: Santiago Ruano Rincón <santiago@debian.org>
Description: 
 grep       - GNU grep, egrep and fgrep
Closes: 701897
Changes: 
 grep (2.6.3-3+squeeze1) oldstable; urgency=low
 .
   * Fixes CVE-2012-5667. Patch by Jaroslav Škarvada
     https://bugzilla.redhat.com/show_bug.cgi?id=889935
     Closes: #701897
Checksums-Sha1: 
 78c26f292fab9563324a81ea387175339bbe685b 1156 grep_2.6.3-3+squeeze1.dsc
 a9ccf839c9ba74bfef1a0808e740d596758a7c68 1021770 grep_2.6.3.orig.tar.bz2
 25fc888ee3382a7c924f88ba2cdbc615a7b0cbdb 12974 grep_2.6.3-3+squeeze1.debian.tar.bz2
 7ebde8d23c4efe40d6744ec9f79133c37b7d2150 313920 grep_2.6.3-3+squeeze1_amd64.deb
Checksums-Sha256: 
 a86b48334460e6e776b2c774bb06e84ba96cb3393c487b373a080664873fa436 1156 grep_2.6.3-3+squeeze1.dsc
 d319e79d5b1b3f9331da1db281949f7bc02e385abbf984764f2bb26783005c78 1021770 grep_2.6.3.orig.tar.bz2
 709e7557347bcdcda99be8a7b44750c45f0a709381b9059a7e7bb532fb2050e1 12974 grep_2.6.3-3+squeeze1.debian.tar.bz2
 e0bb207f1446f5b560540df30cee048fe623b5de164c5e035323cffb59de1736 313920 grep_2.6.3-3+squeeze1_amd64.deb
Files: 
 74cf4df68e3ada26246376f7a172ac50 1156 utils required grep_2.6.3-3+squeeze1.dsc
 85f5f78b2b3f55eea05364dd0f49e45a 1021770 utils required grep_2.6.3.orig.tar.bz2
 43ec1e66e5af56ae7a65472f6dfa55b0 12974 utils required grep_2.6.3-3+squeeze1.debian.tar.bz2
 7c8b301e28fc614cd99b04ea87ad0fee 313920 utils required grep_2.6.3-3+squeeze1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlHxfy0ACgkQQUuEI2/szeCyGACeLX+IZ32DdgCG/ntJLUJ1Oh8u
Tx4AnjCjLjMVXal8UVHKMEasp/t3Is0E
=Sbij
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.