lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 13 Oct 2015 14:19:12 +0000
From: Pascal Cuoq <cuoq@...st-in-soft.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Buffer overflow in tiny-AES128-C

The library tiny-AES128-C, available from https://github.com/kokke/tiny-AES128-C , contains a buffer overflow in its AES128_CBC_encrypt_buffer() function, where 15 bytes beyond the end of the input buffer can be overwritten. For instance, if the function is invoked with an input buffer of length 33, the bytes at offsets 33…47 with respect to the beginning of the input buffer will be overwritten. An attacker controlling either the key or the plaintext has some latitude to choose the values of some of the bytes thus overwritten.

A fix for the buffer overflow was first proposed by GitHub user andreas-wehrmann in the form of a pull request: https://github.com/kokke/tiny-AES128-C/pull/18

Vincent Benayoun and I fixed a residual issue (a longish writeup can be found at http://trust-in-soft.com/the-sociology-of-open-source-security-fixes-continued/ )

The principal author for the library, who appeared to have abandoned it at the time, has since fixed compiler warnings in tiny-AES128-C, but has not at the time of this writing integrated any fix for the buffer overflow: https://github.com/kokke/tiny-AES128-C/commit/7c959460a188611c26aa45c54c6e8b96b7ac163a


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists