Bug 980377 (CVE-2016-4804) - VUL-1: CVE-2016-4804: dosfstools: Heap-buffer-overflows in read_fat() and get_fat() functions
Summary: VUL-1: CVE-2016-4804: dosfstools: Heap-buffer-overflows in read_fat() and get...
Status: RESOLVED FIXED
Alias: CVE-2016-4804
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Deadline: 2016-09-15
Assignee: Jan Matejek
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/169117/
Whiteboard: CVSSv2:SUSE:CVE-2016-4804:1.9:(AV:L/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-17 15:02 UTC by Alexander Bergmann
Modified: 2020-07-27 18:16 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2016-05-17 15:02:38 UTC
rh#1336745

Multiple vulnerabilities were found in dosfstools. The variable used for storing the FAT size (in bytes) was an unsignedint. Since the size in sectors read from the BPB was not sufficiently checked, this could end up being zero after multiplying it with the sector size while some offsets still stayed excessive. Ultimately it would cause segfaults when accessing FAT entries for which no memory
was allocated.

External references:

https://github.com/dosfstools/dosfstools/issues/25
https://github.com/dosfstools/dosfstools/issues/26
https://blog.fuzzing-project.org/44-dosfstools-fsck.vfat-Several-invalid-memory-accesses.html

Upstream fix:

https://github.com/dosfstools/dosfstools/commit/e8eff147e9da1185f9afd5b25948153a3b97cf52

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1336745
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4804
http://seclists.org/oss-sec/2016/q2/343
Comment 1 Swamp Workflow Management 2016-05-17 22:02:02 UTC
bugbot adjusting priority
Comment 3 Jan Matejek 2016-05-24 14:17:04 UTC
SRs sent for SLE12, SLE11-SP4 and SLE11-SP2
also for 13.2 and Leap 42.1. Factory has version 4.0 which is not affected.

waiting for instructions for SLE11 and SLE10-SP3
Comment 5 Bernhard Wiedemann 2016-05-24 15:00:38 UTC
This is an autogenerated message for OBS integration:
This bug (980377) was mentioned in
https://build.opensuse.org/request/show/397723 13.2+42.1 / dosfstools
Comment 7 Swamp Workflow Management 2016-06-01 13:08:55 UTC
openSUSE-SU-2016:1461-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 912607,980364,980377
CVE References: CVE-2015-8872,CVE-2016-4804
Sources used:
openSUSE Leap 42.1 (src):    dosfstools-3.0.26-6.1
openSUSE 13.2 (src):    dosfstools-3.0.26-3.8.1
Comment 8 Swamp Workflow Management 2016-08-24 15:09:55 UTC
SUSE-SU-2016:2145-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 912607,980364,980377
CVE References: CVE-2015-8872,CVE-2016-4804
Sources used:
SUSE Linux Enterprise Server 12-SP1 (src):    dosfstools-3.0.26-6.5
SUSE Linux Enterprise Desktop 12-SP1 (src):    dosfstools-3.0.26-6.5
Comment 9 Swamp Workflow Management 2016-08-24 15:10:31 UTC
SUSE-SU-2016:2146-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 980364,980377
CVE References: CVE-2015-8872,CVE-2016-4804
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    dosfstools-3.0.26-3.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    dosfstools-3.0.26-3.1
Comment 11 Swamp Workflow Management 2016-09-01 12:15:46 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2016-09-15.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/63012
Comment 12 Swamp Workflow Management 2016-09-04 12:09:27 UTC
openSUSE-SU-2016:2233-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 912607,980364,980377
CVE References: CVE-2015-8872,CVE-2016-4804
Sources used:
openSUSE Leap 42.1 (src):    dosfstools-3.0.26-9.1
Comment 13 Marcus Meissner 2016-09-28 15:08:16 UTC
released