Bug 882600 (CVE-2014-4043) - VUL-0: CVE-2014-4043: glibc,glibc.i686: posix_spawn_file_actions_addopen fails to copy the path argument
Summary: VUL-0: CVE-2014-4043: glibc,glibc.i686: posix_spawn_file_actions_addopen fail...
Status: RESOLVED FIXED
: 939797 (view as bug list)
Alias: CVE-2014-4043
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Major
Target Milestone: ---
Deadline: 2014-06-27
Assignee: Andreas Schwab
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/99579/
Whiteboard: maint:released:sle11-sp3:58118 maint:...
Keywords: DSLA_REQUIRED, DSLA_SOLUTION_PROVIDED
Depends on:
Blocks:
 
Reported: 2014-06-13 08:39 UTC by Johannes Segitz
Modified: 2018-10-19 18:24 UTC (History)
7 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
reproducer (944 bytes, text/x-c++src)
2014-06-13 08:40 UTC, Johannes Segitz
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2014-06-13 08:39:40 UTC
OSS:2014/Q2/519

David Reid, Glyph Lefkowitz, and Alex Gaynor] discovered a bug which can lead to a use after free, or other vulnerabilities.

Per the specification (http://pubs.opengroup.org/onlinepubs/000095399/functions/posix_spawn_file_actions_addclose.html) posix_spawn_file_actions_addopen should copy the path argument. The result of not copying is that programs can easily trigger use-after-free bugs, or other situations where the path is mutated

References:
https://sourceware.org/bugzilla/show_bug.cgi?id=17048
http://seclists.org/oss-sec/2014/q2/519
Comment 1 Johannes Segitz 2014-06-13 08:40:50 UTC
Created attachment 594558 [details]
reproducer
Comment 2 Swamp Workflow Management 2014-06-13 08:57:42 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2014-06-27.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/57820
Comment 4 Swamp Workflow Management 2014-06-13 22:00:16 UTC
bugbot adjusting priority
Comment 5 Bernhard Wiedemann 2014-06-17 11:00:34 UTC
This is an autogenerated message for OBS integration:
This bug (882600) was mentioned in
https://build.opensuse.org/request/show/237681 Factory / glibc
Comment 12 Swamp Workflow Management 2014-07-18 23:06:59 UTC
SUSE-SU-2014:0920-1: An update that solves one vulnerability and has one errata is now available.

Category: security (moderate)
Bug References: 882600,883217
CVE References: CVE-2014-4043
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    glibc-2.11.3-17.66.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    glibc-2.11.3-17.66.1
SUSE Linux Enterprise Server 11 SP3 (src):    glibc-2.11.3-17.66.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    glibc-2.11.3-17.66.1
Comment 13 Victor Pereira 2014-07-30 12:26:46 UTC
fixed and released
Comment 14 Swamp Workflow Management 2014-09-12 04:06:30 UTC
SUSE-SU-2014:1122-1: An update that solves 7 vulnerabilities and has 6 fixes is now available.

Category: security (important)
Bug References: 750741,779320,801246,830268,834594,836746,839870,843735,864081,882600,883022,886416,892073
CVE References: CVE-2012-4412,CVE-2013-0242,CVE-2013-4237,CVE-2013-4332,CVE-2013-4788,CVE-2014-4043,CVE-2014-5119
Sources used:
SUSE Linux Enterprise Server 11 SP1 LTSS (src):    glibc-2.11.1-0.58.1
Comment 15 Swamp Workflow Management 2014-09-15 17:05:58 UTC
SUSE-SU-2014:1128-1: An update that solves 6 vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 779320,801246,824639,834594,839870,842291,860501,882600,892073,894553,894556
CVE References: CVE-2012-4412,CVE-2013-0242,CVE-2013-4237,CVE-2013-4332,CVE-2014-4043,CVE-2014-5119
Sources used:
SUSE Linux Enterprise Server 10 SP3 LTSS (src):    glibc-2.4-31.77.112.1
Comment 26 Swamp Workflow Management 2015-01-29 00:07:49 UTC
SUSE-SU-2015:0167-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 864081,882600,909053
CVE References: CVE-2012-6656,CVE-2014-6040
Sources used:
SUSE Linux Enterprise Server 11 SP2 LTSS (src):    glibc-2.11.3-17.45.57.6
Comment 27 Swamp Workflow Management 2015-01-29 05:05:17 UTC
SUSE-SU-2015:0170-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 844309,882600,894553,894556
CVE References: CVE-2012-6656,CVE-2013-4357,CVE-2014-6040
Sources used:
SUSE Linux Enterprise Server 10 SP4 LTSS (src):    glibc-2.4-31.115.2
Comment 28 Andreas Stieger 2015-07-29 09:36:40 UTC
Reopen for bug 939797 for openSUSE 13.1 update.
Comment 29 Andreas Stieger 2015-07-29 09:37:24 UTC
*** Bug 939797 has been marked as a duplicate of this bug. ***
Comment 30 Andreas Stieger 2015-07-29 09:39:12 UTC
We have received indication that this affects openSUSE 13.1. Please verify and submit.
Comment 31 Bernhard Wiedemann 2015-07-30 14:00:09 UTC
This is an autogenerated message for OBS integration:
This bug (882600) was mentioned in
https://build.opensuse.org/request/show/319594 13.1 / glibc
Comment 32 Swamp Workflow Management 2015-08-14 14:09:42 UTC
openSUSE-SU-2015:1387-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 882600
CVE References: CVE-2014-4043
Sources used:
openSUSE 13.1 (src):    glibc-2.18-4.38.1, glibc-2.18-4.38.2, glibc-testsuite-2.18-4.38.3, glibc-utils-2.18-4.38.2
Comment 33 Andreas Schwab 2016-06-06 09:57:06 UTC
All updates released.