[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Re: Full disclosure: denial of service in srvx
From:       cve-assign () mitre ! org
Date:       2014-08-30 1:27:13
Message-ID: 20140830012713.7DB46332007 () smtpvbsrv1 ! mitre ! org
[Download RAW message or body]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Putting an extremely high value to these parameters, such as
> 184467440723049 will lead to an integer overflow. When attempting to
> queue the function execution, srvx will add it in the past, will attempt
> to execute it immediately and thus will loop forever on this, and will
> finally crash due to memory exhaustion.

Use CVE-2014-5508 for the integer overflow.


> most generic fix. It is here to deny any function adding in the past.

(As far as we could tell from your discussion, there is no way for an
attacker to specify a negative number directly. That situation would
require a separate CVE ID. In other words, the patch to timeq.c
apparently detects a condition that's possible only after an integer
overflow occurs.)

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJUASdPAAoJEKllVAevmvms/A8H/3123WncqL1ImFXko4/AVfMW
zbhQDGo4NGwVeBNLUPl6G+u/nnFcVtRwQaqG3vKWM6ZgsXUjhSSWhlfPtE6vEvPo
QA6Vz/SUd8zs91iNtERyAsWaTcSHR4nVTJ4dBW7hfQWEtI2T3COL8jpcwdsfRHmq
hLDXoY7Ixn3P/494exKKJ276fLv+vG9cqdPk+Tx668c31lkcInv5MNr963v+3JQd
UHFXhGnSh7tPH1O5ro5KK5fJa632EwHidc/Ozyksi5QrVasn1D6xByToMkxRUU+s
cIlPBQVdFeHHc3LONZtxgF/851DCcxigmLlWqmE7xFP5ouut5Jk4YYrQJ92WtFk=
=Gxld
-----END PGP SIGNATURE-----
[prev in list] [next in list] [prev in thread] [next in thread]