bugtraq - Re: Linux ISO9660 handling flaws

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0503180242050.21467-100000@D00M.lightwave.net.ru>
Date: Fri, 18 Mar 2005 02:46:03 +0300 (MSK)
From: Dan Yefimov <dan@...htwave.net.ru>
To: Michal Zalewski <lcamtuf@...ne.ids.pl>
Cc: bugtraq@...urityfocus.com
Subject: Re: Linux ISO9660 handling flaws


On Thu, 17 Mar 2005, Michal Zalewski wrote:

> Good morning,
> 
> There appears to be a fair number of kernel-level range checking flaws in
> ISO9660 filesystem handler (and Rock Ridge / Juliet extensions) in Linux
> up to and including 2.6.11. These bugs range from DoS conditions to
> potentially exploitable memory corruption - all this whenever a specially
> crafted filesystem is mounted or directories are examined.
> 
> Most apparent flaws are expected to be fixed in Linux 2.6.12 (rc to show
> up by tomorrow or so), although, as per Linus words, "that code is
> horrid", and it may take some time to work out all the issues.
> 
> The impact is not dramatic, but there are two obvious ways such flaws can
> be used to benefit remote attackers:
> 
>   1) Bugs in removable media filesystems may be used to automatically
>      compromise any system whose owner decided to examine a newly acquired
>      CD-ROM, even if extreme caution is observed (that is, autorun is
>      disabled, and no files are executed).
> 
>   2) For all types of filesystems, such problems can be additionally used
>      to subvert forensic analysis efforts. Disk images from compromised
>      machine may infect forensic examiner's system and alter results,
>      or simply render the machine unusable.
> 
Is this issue 2.6.x-specific, or it applies to 2.4.x branch too? Could you 
please provide more details?
-- 

    Sincerely Your, Dan.