ledger: CVE-2017-2807: Ledger CLI Tags Parsing Code Execution Vulnerability

Debian Bug report logs - #876660
ledger: CVE-2017-2807: Ledger CLI Tags Parsing Code Execution Vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: ledger: CVE-2017-2807: Ledger CLI Tags Parsing Code Execution Vulnerability

Date: Sun, 24 Sep 2017 18:01:14 +0200

Source: ledger
Version: 3.1.2~pre1+g3a00e1c+dfsg1-1
Severity: important
Tags: upstream security

Hi,

the following vulnerability was published for ledger.

CVE-2017-2807[0]:
| An exploitable buffer overflow vulnerability exists in the tag parsing
| functionality of Ledger-CLI 3.1.1. A specially crafted journal file
| can cause an integer underflow resulting in code execution. An
| attacker can construct a malicious journal file to trigger this
| vulnerability.

There is a provided poc.dat to verify the issue/fix:

2003/12/20 Organic Co-op
  Expenses:Food:Groceries             $ 37.50  ; ] [=2004/01/01]

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-2807
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2807
[1] https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0303

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #12 received at 876660@bugs.debian.org (full text, mbox, reply):

From: Martin Michlmayr <tbm@cyrius.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 876660@bugs.debian.org

Subject: Re: Bug#876660: ledger: CVE-2017-2807: Ledger CLI Tags Parsing Code Execution Vulnerability

Date: Sat, 26 Jan 2019 13:19:03 -0300

* Salvatore Bonaccorso <carnil@debian.org> [2017-09-24 18:01]:
> the following vulnerability was published for ledger.
> 
> CVE-2017-2807[0]:
> | An exploitable buffer overflow vulnerability exists in the tag parsing
> | functionality of Ledger-CLI 3.1.1. A specially crafted journal file
> | can cause an integer underflow resulting in code execution. An
> | attacker can construct a malicious journal file to trigger this
> | vulnerability.

Fixed here:
https://github.com/ledger/ledger/commit/5682f377aed5b0db6b6c4a44b1d8868103b7e9f7

-- 
Martin Michlmayr
https://www.cyrius.com/

Message #19 received at 876660-close@bugs.debian.org (full text, mbox, reply):

From: David Bremner <bremner@debian.org>

To: 876660-close@bugs.debian.org

Subject: Bug#876660: fixed in ledger 3.1.2+dfsg1-1

Date: Wed, 06 Feb 2019 11:34:59 +0000

Source: ledger
Source-Version: 3.1.2+dfsg1-1

We believe that the bug you reported is fixed in the latest version of
ledger, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 876660@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
David Bremner <bremner@debian.org> (supplier of updated ledger package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 06 Feb 2019 06:48:57 -0400
Source: ledger
Architecture: source
Version: 3.1.2+dfsg1-1
Distribution: unstable
Urgency: medium
Maintainer: David Bremner <bremner@debian.org>
Changed-By: David Bremner <bremner@debian.org>
Closes: 684603 716086 740757 839634 870900 876659 876660 913660
Changes:
 ledger (3.1.2+dfsg1-1) unstable; urgency=medium
 .
   [ David Bremner ]
   * Update Vcs-Git and Vcs-Browser for the move to salsa
   * New upstream release.
   * Bug fix: "CVE-2017-2808: Ledger CLI Account Directive Use-After-Free
     Vulnerability", thanks to Salvatore Bonaccorso (Closes: #876659).
   * Bug fix: "CVE-2017-2807: Ledger CLI Tags Parsing Code Execution
     Vulnerability", thanks to Salvatore Bonaccorso (Closes: #876660).
   * Bug fix: "CVE-2017-12481 CVE-2017-12482", thanks to Moritz Muehlenhoff
     (Closes: #870900).
   * Bug fix: "Upgrade to latest upstream git", thanks to Sampo Sorsa
     (Closes: #913660).
   * Bug fix: "[Mayhem] Bug report on ledger: ledger crashes with exit
     status 139", thanks to Alexandre Rebert (Closes: #716086).
   * Give up on Gnucash support (Closes: #740757).
   * Bug fix: "Payee names containing angle brackets (&quot;&lt;&gt;&quot;)
     result in corrupti reports", thanks to Anonymous (Closes: #684603).
   * Bug fix: "short option -f (for --file) missing in manpage", thanks to
     Jonas Meurer (Closes: #839634).
   * Drop binary packages elpa-ledger-mode and ledger-el, moving to new
     source package ledger-mode.
 .
   [ Ondřej Nový ]
   * d/control: Deprecating priority extra as per policy 4.0.1
   * d/rules: Remove trailing whitespaces
Checksums-Sha1:
 4534f5a6835702ee177f49e6f5ce39b2b0cfca18 2140 ledger_3.1.2+dfsg1-1.dsc
 e1c783b461bcf4fd19f95d0f9ffcc09a094330e1 573320 ledger_3.1.2+dfsg1.orig.tar.xz
 319e953de0549c92b61c2e58f656095e8315df05 9460 ledger_3.1.2+dfsg1-1.debian.tar.xz
 57a8f787506f42d8c37bd79aaf44173561f15fad 13362 ledger_3.1.2+dfsg1-1_amd64.buildinfo
Checksums-Sha256:
 3c3ddb14d89f0ff6dc7d71ae40310da6e15fa3f7bc5d3b283853c437734f8d90 2140 ledger_3.1.2+dfsg1-1.dsc
 f68e9911fd116d8564c8ea7cac487bfd1a8ed1bfd0d37d1d1ddd5804260a3336 573320 ledger_3.1.2+dfsg1.orig.tar.xz
 e99a016d6d7bf02a6443b6de06776ead19779667c6706655fc539572d5bca3fc 9460 ledger_3.1.2+dfsg1-1.debian.tar.xz
 483d63c59a6e4d1365daa5152e4b39427753834bdbec8a561ca4d0695f89719f 13362 ledger_3.1.2+dfsg1-1_amd64.buildinfo
Files:
 d252f0563f6cc7d0bfd9f49e1187bbc0 2140 utils optional ledger_3.1.2+dfsg1-1.dsc
 24e90d15949058f7f9a27b7f0fa8ef6c 573320 utils optional ledger_3.1.2+dfsg1.orig.tar.xz
 b7253c928fe1d5357dcff594caff900a 9460 utils optional ledger_3.1.2+dfsg1-1.debian.tar.xz
 3e2534d69bcdef2ff2da3005d2447d69 13362 utils optional ledger_3.1.2+dfsg1-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEE3VS2dnyDRXKVCQCp8gKXHaSnniwFAlxaw/AACgkQ8gKXHaSn
niym3wv/bmdILGDmHW1fjs05ci1aiacLS5usVtQDxXo9Is2oj22rxoQaZaQ+WxSb
Clh0sWW9MCWqiGsNH4YfYMO+n1BZW/IbYQt7PIVKRGSjQHGwN8z6tGXtgBdcJWMa
1KQZQPCWlNd9n4jm4HteaYzvCqTyFjdfZxKVIqg8Ah+C/+20BRPjvm1hRdKDjCzq
FQeZBqqFngySFBPnu5F7ZrtzTc3QTVEcHxV+rtK/bCIdF+zDiLcaf2LqGygAewQy
59JtabAaOOuj4DJxB2ASIiEv5DPLT2tDrESxnL6/9dmwW8UzjPNtpFjesJo9GDim
PkmM3VvFyE8nwJCLl6pFeSHNrehbNxAGRNCCfxAzqbC5SGqCywWBlfNSqT3gJS5M
od1M2KWKBI0uUCHShqaw2ycN8q/3VL5qIAkCTgXmRqC37U6gwI6Whn2jyr2koAOw
eS+ePJ9MY1d6qkCm8sdG+rh9xCE+iGVfwPkCUpgeIBFaPuOzGYEE04BzWVNFN32k
KeLW6e++
=32Gm
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.