smstools: Format string attack in logging code

Debian Bug report logs - #347221
smstools: Format string attack in logging code

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steve Kemp <skx@debian.org>

To: submit@bugs.debian.org

Subject: smstools: Format string attack in logging code

Date: Mon, 9 Jan 2006 14:44:57 +0000

Package: smstools
Version: 1.16-1+b1
Severity: grave
Justification: user security hole
Tags: security

*** Please type your report below this line ***

  A DSA has just been released for smstools due to an insecure
 usage of syslog in the logging code.

  The following patch will correct the issue:

--- smstools-1.14.8.orig/src/logging.c
+++ smstools-1.14.8/src/logging.c
@@ -78,7 +78,7 @@
   va_end(argp);
   if (Filehandle<0)
   {
-    syslog(severity,text);
+    syslog(severity,"%s",text);
   }
   else
   {


Steve
--

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12.6-xen
Locale: LANG=en_GB, LC_CTYPE=en_GB (charmap=ISO-8859-1)

Versions of packages smstools depends on:
ii  libc6                         2.3.5-11   GNU C Library: Shared libraries an
ii  libmm14                       1.4.0-1    Shared memory library - runtime

smstools recommends no packages.

-- no debconf information

Message #10 received at 347221@bugs.debian.org (full text, mbox, reply):

From: Florian Weimer <fw@deneb.enyo.de>

To: Steve Kemp <skx@debian.org>

Cc: 347221@bugs.debian.org

Subject: Re: Bug#347221: smstools: Format string attack in logging code

Date: Mon, 09 Jan 2006 18:23:05 +0100

* Steve Kemp:

>   A DSA has just been released for smstools due to an insecure
>  usage of syslog in the logging code.

Please mention the CVE name CVE-2006-0083 in the changelog when fixing
this bug.

Message #15 received at 347221@bugs.debian.org (full text, mbox, reply):

From: Florian Weimer <fw@deneb.enyo.de>

To: 347221@bugs.debian.org

Subject: NMU patch

Date: Mon, 23 Jan 2006 13:57:16 +0100

Here's the actual patch I used for the NMU (Steve's doesn't apply
cleanly).

diff --git a/debian/changelog b/debian/changelog
index a9794e3..c84c65c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+smstools (1.16-1.1) unstable; urgency=high
+
+  * Non-maintainer upload
+  * CVE-2006-0083: Apply patch to fix format string issue
+    in logging code.  Closes: #347221.
+
+ -- Florian Weimer <fw@deneb.enyo.de>  Mon, 23 Jan 2006 13:49:46 +0100
+
 smstools (1.16-1) unstable; urgency=low
 
   * New upstream release
diff --git a/src/logging.c b/src/logging.c
index f33ff8b..5e9974e 100644
--- a/src/logging.c
+++ b/src/logging.c
@@ -83,7 +83,7 @@ void writelogfile(int severity,char* for
   if (severity<=Level)
   {
     if (Filehandle<0)
-      syslog(severity,text);
+      syslog(severity,"%s",text);
     else
     {
       time(&now);

Message #22 received at 347221-submitter@bugs.debian.org (full text, mbox, reply):

From: "Adam D. Barratt" <debian-bts@adam-barratt.org.uk>

To: 347221-submitter@bugs.debian.org

Subject: Debian bug #347221

Date: Thu, 26 Oct 2006 20:33:32 +0100

Hi,

You should have recently received (or will soon receive) an e-mail
telling you that I've closed Debian bug #347221 in the smstools 
package, which you reported.

Due to the fact that the package was uploaded by someone who does not
normally do so, the bug was marked as "fixed" rather than closed.

Debian's bug tracking system now allows for this information to be
recorded in a more useful manner, enabling these bugs to be closed.

Due to the volume of bugs affected by this change, we are unfortunately
not sending individualized explanations for each bug. If you have
questions about the fix for your particular bug or about this email,
please contact me directly or follow up to the bug report in the Debian
BTS.

[It's possible you may receive multiple messages stating that the bug
was fixed in several different versions of the package. There are two
common reasons for this:

  - the bug was fixed in one version but subsequently found to exist
    in a later version

  - the bug existed in multiple distributions (for instance, "unstable"
    and "stable") and was thus fixed in a separate upload to each
    distribution
]

Regards,

Adam

Send a report that this bug log contains spam.