Bug 923618 (CVE-2015-2675) - VUL-0: CVE-2015-2675: librest: oauth implicit declaration of rest_proxy_call_get_url leads to memory error
Summary: VUL-0: CVE-2015-2675: librest: oauth implicit declaration of rest_proxy_call_...
Status: RESOLVED INVALID
Alias: CVE-2015-2675
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Scott Reeves
QA Contact: Security Team bot
URL: https://bugzilla.gnome.org/show_bug.c...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-23 09:02 UTC by Andreas Stieger
Modified: 2015-03-23 15:47 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-03-23 09:02:55 UTC 
Via oss-sec:

The OAuth implementation in librest, a helper library for RESTful
services part of the GNOME project, incorrectly truncates the pointer
returned by the rest_proxy_call_get_url function call, leading to an
application crash, or worse.

Upstream bug: https://bugzilla.gnome.org/show_bug.cgi?id=742644
Commit: https://git.gnome.org/browse/librest/commit/?id=b50ace7738ea038
See also: https://bugzilla.redhat.com/show_bug.cgi?id=1183982

The security impact was noted in 2015, although the bug was fixed in 2014.

Use CVE-2015-2675.
Comment 1 Andreas Stieger 2015-03-23 09:09:54 UTC 
Affected: <= 0.7.72
Fixed   : >= 0.7.93

openSUSE:13.1    librest 0.7.90 affected
openSUSE:13.2    librest 0.7.92 not affected (librest-missing-include.patch)
openSUSE:Factory librest 0.7.93 fixed
Comment 3 Andreas Stieger 2015-03-23 09:46:26 UTC 
This would need to be developed in to a reproducer:
https://bugzilla.gnome.org/show_bug.cgi?id=742644#c0
Comment 4 Andreas Stieger 2015-03-23 15:44:12 UTC 
(In reply to Andreas Stieger from comment #1)
> Affected: <= 0.7.72
> Fixed   : >= 0.7.93
> 
> openSUSE:13.1    librest 0.7.90 affected
> openSUSE:13.2    librest 0.7.92 not affected (librest-missing-include.patch)
> openSUSE:Factory librest 0.7.93 fixed

Checked code again...Correction:

Not affected: < 0.7.92
Affected:     = 0.7.92
Fixed   :    >= 0.7.93

The header inclusion has been removed in 0.7.92 only. Does however not affect openSUSE 13.2 as a patch was added to fix the warning-error.

Does not affect SLE 12.
Comment 5 Dominique Leuenberger 2015-03-23 15:47:40 UTC 
(In reply to Andreas Stieger from comment #4)
> Not affected: < 0.7.92
> Affected:     = 0.7.92
> Fixed   :    >= 0.7.93
> 
> The header inclusion has been removed in 0.7.92 only. Does however not
> affect openSUSE 13.2 as a patch was added to fix the warning-error.

Let's praise our brp check to catching that in first place.