Debian Bug report logs - #310139
kmd: Integer overflow in ELF header parsing

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: kmd: Integer overflow in ELF header parsing

Date: Sun, 22 May 2005 01:34:37 +0200

Package: kmd
Version: 0.9.19-1
Severity: grave
Tags: security
Justification: user security hole

kmd uses binutils-dev's BFD library for ELF header parsing and is therefore
vulnerable to it's integer overflow in ELF segment handling. kmd needs to be
recompiled against binutils-dev 2.15-6 once this has entered the archive.

I've verified a that a complete rebuild with binutils-dev from incoming.d.o
correctly refuses the invalid ELF header of the crafted test binary.

Cheers,
        Moritz

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.11
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15@euro (charmap=ISO-8859-15)

Versions of packages kmd depends on:
ii  libc6                2.3.2.ds1-21        GNU C Library: Shared libraries an
ii  libglib1.2           1.2.10-10           The GLib library of C routines
ii  libgtk1.2            1.2.10-17           The GIMP Toolkit set of widgets fo
ii  libx11-6             4.3.0.dfsg.1-12.0.1 X Window System protocol client li
ii  libxext6             4.3.0.dfsg.1-12.0.1 X Window System miscellaneous exte
ii  libxi6               4.3.0.dfsg.1-12.0.1 X Window System Input extension li
ii  xlibs                4.3.0.dfsg.1-12     X Keyboard Extension (XKB) configu

-- no debconf information

Message #10 received at 310139@bugs.debian.org (full text, mbox, reply):

From: Roger Leigh <rleigh@whinlatter.ukfsn.org>

To: 310139@bugs.debian.org, debian-release@lists.debian.org

Cc: control@bugs.debian.org

Subject: Re: kmd: Integer overflow in ELF header parsing

Date: Wed, 25 May 2005 14:37:26 +0100

tags 310139 + patch sarge
thanks

I have done an NMU to rebuild against the new binutils-dev.  The
changes are as detailed in the diff below.

Release Team: please could you approve this for sarge?


Regards,
Roger


--- kmd.orig/kmd-0.9.19/debian/changelog	2005-05-25 13:47:38.178957288 +0100
+++ kmd.new/kmd-0.9.19/debian/changelog	2005-05-25 13:50:36.954779232 +0100
@@ -1,3 +1,11 @@
+kmd (0.9.19-1.1) unstable; urgency=high
+
+  * Non-maintainer upload.
+  * Build-Depend on binutils-dev >= 2.15-6, in order to prevent an
+    integer overflow in ELF header parsing (Closes: #310139).
+
+ -- Roger Leigh <rleigh@debian.org>  Wed, 25 May 2005 13:48:47 +0100
+
 kmd (0.9.19-1) unstable; urgency=low
 
   * New upstream release.
--- kmd.orig/kmd-0.9.19/debian/control	2005-05-25 13:47:38.179957136 +0100
+++ kmd.new/kmd-0.9.19/debian/control	2005-05-25 13:48:28.401322328 +0100
@@ -2,7 +2,7 @@
 Section: devel
 Priority: optional
 Maintainer: Jose M. Moya <josem@die.upm.es>
-Build-Depends: debhelper (>= 4.0.0), libgtk1.2-dev, autotools-dev, binutils-dev
+Build-Depends: debhelper (>= 4.0.0), libgtk1.2-dev, autotools-dev, binutils-dev (>= 2.15-6)
 Standards-Version: 3.6.1
 
 Package: kmd

-- 
Roger Leigh
                Printing on GNU/Linux?  http://gimp-print.sourceforge.net/
                Debian GNU/Linux        http://www.debian.org/
                GPG Public Key: 0x25BFB848.  Please sign and encrypt your mail.

Message #21 received at 310139@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Roger Leigh <rleigh@whinlatter.ukfsn.org>

Cc: 310139@bugs.debian.org, debian-release@lists.debian.org, control@bugs.debian.org

Subject: Re: kmd: Integer overflow in ELF header parsing

Date: Thu, 26 May 2005 01:31:05 -0700

[Message part 1 (text/plain, inline)]

On Wed, May 25, 2005 at 02:37:26PM +0100, Roger Leigh wrote:
> I have done an NMU to rebuild against the new binutils-dev.  The
> changes are as detailed in the diff below.

> Release Team: please could you approve this for sarge?

Yep, approved.

Thanks,
-- 
Steve Langasek
postmodern programmer

[signature.asc (application/pgp-signature, inline)]

Message #30 received at 310139-done@bugs.debian.org (full text, mbox, reply):

From: "Jose M. Moya" <josem@die.upm.es>

To: 310139-done@bugs.debian.org

Subject: Re: kmd: Integer overflow in ELF header parsing

Date: Tue, 07 Jun 2005 13:33:28 +0200

Patch applied to my build tree.

Closing as no new version is expected in the near future and there is no
reason for a new upload.

Send a report that this bug log contains spam.