Debian Bug report logs - #862556
CVE-2017-9058: Heap-based buffer overflow due to incorrect boundary checking

version graph

Package: libytnef; Maintainer for libytnef is Ricardo Mones <mones@debian.org>;

Reported by: "bingosxs" <bingosxs@qq.com>

Date: Sun, 14 May 2017 15:06:02 UTC

Severity: serious

Tags: security

Found in version 1.5-6

Fixed in version libytnef/1.9.2-2

Done: Jordi Mallach <jordi@debian.org>

Bug is archived. No further changes may be made.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian QA Group <packages@qa.debian.org>:
Bug#862556; Package libytnef. (Sun, 14 May 2017 15:06:04 GMT) (full text, mbox, link).


Acknowledgement sent to "bingosxs" <bingosxs@qq.com>:
New Bug report received and forwarded. Copy sent to Debian QA Group <packages@qa.debian.org>. (Sun, 14 May 2017 15:06:04 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "bingosxs" <bingosxs@qq.com>
To: "submit" <submit@bugs.debian.org>
Subject: heap-buffer-overflow vulnerability in the SIZECHCK
Date: Sun, 14 May 2017 22:55:03 +0800
[Message part 1 (text/plain, inline)]
Package: libytnef 
 Version:  1.5-6+deb8u1
 Severity:  normal
 Tags: security
 
 
 Hi,
   We found a heap-buffer-overflow vulnerability in the libytnef.
 This affects both 1.5-6+deb8u1 and 1.9.1 .
 The cause is an incorrect boundary checking in SIZECHCK macro in  lib/ytnef.c:39
 -- #define SIZECHECK(x) { if ((((char *)d - (char *)data) + x) >  size) {  printf("Corrupted file detected at %s : %i\n", __FILE__,  __LINE__); return(-1); } }
 ++ #define SIZECHECK(x) { if ((((char *)d - (char *)data) + x) >=  size) {  printf("Corrupted file detected at %s : %i\n", __FILE__,  __LINE__); return(-1); } }
   
   
 To verify this, use the testcase from:
 https://github.com/bingosxs/fuzzdata/blob/master/ytnef-1.9/TNEFFreeMapiProps-Invalid-read.tnef?raw=true
   
 run the sample with command:
 
 ytnef/.libs/ytnef -v @@


The tracelog is:
=================================================================
==15221==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ef90 at pc 0x7f7f8986e69f bp 0x7ffe3fc1b820 sp 0x7ffe3fc1b818
READ of size 4 at 0x60200000ef90 thread T0
    #0 0x7f7f8986e69e in SwapDWord /home/canicula/afl/test/libytnef0/libytnef-1.5.x/ytnef.c:136:12
    #1 0x7f7f8986e69e in TNEFPriority /home/canicula/afl/test/libytnef0/libytnef-1.5.x/ytnef.c:670
    #2 0x7f7f8987ac87 in TNEFParse /home/canicula/afl/test/libytnef0/libytnef-1.5.x/ytnef.c:1076:29
    #3 0x7f7f8987997f in TNEFParseFile /home/canicula/afl/test/libytnef0/libytnef-1.5.x/ytnef.c:936:12
    #4 0x4ea71b in main /home/canicula/afl/test/ytnef.0/ytnef/main.c:125:9
    #5 0x7f7f8897782f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/../csu/libc-start.c:291
    #6 0x418bd8 in _start (/data/canicula/afl/test/ytnef.0/ytnef/.libs/ytnef+0x418bd8)

0x60200000ef92 is located 0 bytes to the right of 2-byte region [0x60200000ef90,0x60200000ef92)
allocated by thread T0 here:
    #0 0x4b8e90 in calloc (/data/canicula/afl/test/ytnef.0/ytnef/.libs/ytnef+0x4b8e90)
    #1 0x7f7f8987a29d in TNEFParse /home/canicula/afl/test/libytnef0/libytnef-1.5.x/ytnef.c:1046:20
    #2 0x7f7f8987997f in TNEFParseFile /home/canicula/afl/test/libytnef0/libytnef-1.5.x/ytnef.c:936:12
    #3 0x4ea71b in main /home/canicula/afl/test/ytnef.0/ytnef/main.c:125:9
    #4 0x7f7f8897782f in __libc_start_main /build/glibc-9tT8Do/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/canicula/afl/test/libytnef0/libytnef-1.5.x/ytnef.c:136:12 in SwapDWord
Shadow bytes around the buggy address:
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9df0: fa fa[02]fa fa fa 00 fa fa fa fd fa fa fa fd fa
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==15221==ABORTING
[Message part 2 (text/html, inline)]

Marked as found in versions 1.5-6. Request was from Adrian Bunk <bunk@debian.org> to control@bugs.debian.org. (Sun, 14 May 2017 18:51:03 GMT) (full text, mbox, link).


Added tag(s) security. Request was from Adrian Bunk <bunk@debian.org> to control@bugs.debian.org. (Sun, 14 May 2017 18:51:04 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, Debian QA Group <packages@qa.debian.org>:
Bug#862556; Package libytnef. (Thu, 18 May 2017 06:15:03 GMT) (full text, mbox, link).


Acknowledgement sent to Sébastien Delafond <seb@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian QA Group <packages@qa.debian.org>. (Thu, 18 May 2017 06:15:03 GMT) (full text, mbox, link).


Message #14 received at 862556@bugs.debian.org (full text, mbox, reply):

From: Sébastien Delafond <seb@debian.org>
To: 862556@bugs.debian.org
Subject: CVE-2017-9058
Date: Thu, 18 May 2017 08:12:59 +0200
This was assigned CVE-2017-9058.



Changed Bug title to 'CVE-2017-9058: Heap-based buffer overflow due to incorrect boundary checking' from 'heap-buffer-overflow vulnerability in the SIZECHCK'. Request was from Sebastien Delafond <seb@debian.org> to control@bugs.debian.org. (Thu, 18 May 2017 06:39:02 GMT) (full text, mbox, link).


Severity set to 'serious' from 'normal' Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Tue, 23 May 2017 05:06:02 GMT) (full text, mbox, link).


Reply sent to Jordi Mallach <jordi@debian.org>:
You have taken responsibility. (Wed, 24 May 2017 09:09:03 GMT) (full text, mbox, link).


Notification sent to "bingosxs" <bingosxs@qq.com>:
Bug acknowledged by developer. (Wed, 24 May 2017 09:09:03 GMT) (full text, mbox, link).


Message #23 received at 862556-close@bugs.debian.org (full text, mbox, reply):

From: Jordi Mallach <jordi@debian.org>
To: 862556-close@bugs.debian.org
Subject: Bug#862556: fixed in libytnef 1.9.2-2
Date: Wed, 24 May 2017 09:05:44 +0000
Source: libytnef
Source-Version: 1.9.2-2

We believe that the bug you reported is fixed in the latest version of
libytnef, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 862556@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jordi Mallach <jordi@debian.org> (supplier of updated libytnef package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 22 May 2017 23:51:52 +0200
Source: libytnef
Binary: libytnef0 libytnef0-dev ytnef-tools
Architecture: source amd64
Version: 1.9.2-2
Distribution: unstable
Urgency: medium
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Jordi Mallach <jordi@debian.org>
Description:
 libytnef0  - improved decoder for application/ms-tnef attachments
 libytnef0-dev - headers for application/ms-tnef attachments decoder
 ytnef-tools - ytnef decoder commandline tools
Closes: 862556
Changes:
 libytnef (1.9.2-2) unstable; urgency=medium
 .
   * Add CVE information to previous changelog entry.
   * Add CVE-2017-9058.patch: Fix a heap buffer overflow in SIZECHECK macro
     (closes: #862556).
Checksums-Sha1:
 b4d233b9302c976f28185e2503eb383fcc7dea94 1950 libytnef_1.9.2-2.dsc
 bfe7827a79fc6a5e1260c847088a7dea735e881b 4628 libytnef_1.9.2-2.debian.tar.xz
 72b47158560736cea511cb1a30147a6046c1d09f 29166 libytnef0-dbgsym_1.9.2-2_amd64.deb
 e819f959c89191e23f414cbead00c0f39f7bda1c 31370 libytnef0-dev_1.9.2-2_amd64.deb
 b732f318b482e11a64641fb19e0f6eb4a5ec318e 24866 libytnef0_1.9.2-2_amd64.deb
 990f6e2d6ce2a58cc320449f2881bbe72ab8bdd1 6534 libytnef_1.9.2-2_amd64.buildinfo
 cc9a3be334d3ced5982b801b0f80a8faf303e52c 31980 ytnef-tools-dbgsym_1.9.2-2_amd64.deb
 2b22b220a75369b234910aaf7f53edfafadc08f9 20548 ytnef-tools_1.9.2-2_amd64.deb
Checksums-Sha256:
 0c2ec01a02ff8f91d32274a84a2bf26764ef803d51aa2b2182ce497385fcd7ff 1950 libytnef_1.9.2-2.dsc
 a06aaf2c2825ac4c44616789bf7228540c54073a10df30dbe9b218d58053598f 4628 libytnef_1.9.2-2.debian.tar.xz
 562c1f42323df3bbb7277f9037de0f2ad98bc64ac7282dec69af0c351f5841f0 29166 libytnef0-dbgsym_1.9.2-2_amd64.deb
 0304c5265f2dff1fe7ff578fb1f79f19dfe5091640fcac47763228632cd9d8a2 31370 libytnef0-dev_1.9.2-2_amd64.deb
 b13456240527b60901d943ab4dcd5c038df8b8a72b72c88ce9b7079227114c7d 24866 libytnef0_1.9.2-2_amd64.deb
 66c93f0576b54d83c876225f33aadf1838b16f552cdf162e70cb903856a13cc6 6534 libytnef_1.9.2-2_amd64.buildinfo
 65aca82ac362cc5b555dde24aa4667183851565803db6223c4326326ecf947b0 31980 ytnef-tools-dbgsym_1.9.2-2_amd64.deb
 222a4531b08d5fc0e43216dee2f2b26c98268cb225deb35a735d6c8011f4cebf 20548 ytnef-tools_1.9.2-2_amd64.deb
Files:
 2249def91c97a2065318f76e21899e84 1950 utils extra libytnef_1.9.2-2.dsc
 8687934ec21061787b84098092fae3f3 4628 utils extra libytnef_1.9.2-2.debian.tar.xz
 72d4a4d39975e34345a37f591c28c90d 29166 debug extra libytnef0-dbgsym_1.9.2-2_amd64.deb
 9c49b3d506b70c806ae07dcc70e08c94 31370 libdevel extra libytnef0-dev_1.9.2-2_amd64.deb
 e9a5c9885687ebd257e4cd5d33e369c5 24866 libs extra libytnef0_1.9.2-2_amd64.deb
 96e25d14e46dfddd8ff561dfc8197282 6534 utils extra libytnef_1.9.2-2_amd64.buildinfo
 85c8865ceff2df5b7262a4ae4093f381 31980 debug extra ytnef-tools-dbgsym_1.9.2-2_amd64.deb
 7cca14ef47ab4fd4f401b8b2a483e54e 20548 utils extra ytnef-tools_1.9.2-2_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE6BdUhsApKYN8KGoWJVAvb8vjywQFAlkjXjwACgkQJVAvb8vj
ywSmSxAAov7E+yqUQ7ZCXgNk720ttqDBIs/IQUKaON+O9mC5g+SYQhL0Wr2VNiwA
Jk41+napkakyUd0zSqEj9i9lXkrhsCBJ3tLs4ln0MAMmSWiv8pAbjQmsWSrwXfYO
rSdH9OQ2Xx7VJf7DSNGbytFAJiLdrV0Fv1H4It4stcGQh86Cw6lOG/D1lZI3Uvxm
o2gF3wQh1ila65wrqoc0vhj/bbNQ+YOTuhuAgE/a3GGnVBAtwD3EzSj+M1vu9Uld
3C02yCU9GbzE2dW0T+EO/fcolSxwGxRnzgRBWukiVNUc4tXlfzDs0rwCGERVvyo+
qq7E8mVqLyJH1ciHr2JVYaYP7Wn8XTnKdPLrzZStQXCWwl791Vj6FzD5jR7h/5O1
XtDLEm59yma6w8G2L5DPoLZP66FwHTzfHag7aVF6MJ+8Lgu3XuOzUG6PM6Y2X3QN
bKwIyMQmIWRT/CODKL0gSWbOaMeIxOqwD0Q0jKeL+KeXLZypI2eLyWkYFmqqJKS9
o1Yp3gDwabfSgCr/xuN+PoWm1QiPPcc6FhwuMHxbpDyEmOrmaVTWVtUC5G2Bo7PJ
4bYhEuVSR9v7P0Zg/+mQMqHjqR4yY3axAIEOt9C1oJfuSmJenLnWCA+hdJLrQJWt
T1XGTAUZTLxMh+Df64sNH17oa8OHvVQ5YrEQFLhqdzFRtZ+LTaw=
=Ak1m
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 16 Jul 2017 07:45:01 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Apr 20 05:43:03 2025; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.