[arch-security] [Arch Linux Security Advisory ASA-201411-31] libksba: denial of service

[Remi Gacogne]

Arch Linux Security Advisory ASA-201411-31
==========================================

Severity: Medium
Date    : 2014-11-28
CVE-ID  : CVE-2014-9087
Package : libksba
Type    : denial of service
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE-2014

Summary
=======

The package libksba before version 1.3.2-1 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 1.3.2-1.

# pacman -Syu "libksba>=1.3.2-1"

The problem has been fixed upstream in version 1.3.2.

Workaround
==========

None.

Description
===========

By using special crafted S/MIME messages or ECC based OpenPGP data, it
is possible to create a buffer overflow.  The bug is not easy to exploit
because there only 80 possible values which can be used to overwrite
memory.  However, a denial of service is possible and someone may come
up with other clever attacks.  Thus this should be fix.

Background: Hanno Böck found an invalid memory access in the
2.1 branch of GnuPG by conveying a malformed OID as part of an ECC key.
It turned out that this bug has also been in libksba ever since and
affects at least gpgsm and dirmngr.  The code to convert an OID to its
string representation has an obvious error of not considering an invalid
encoding for arc-2.  A first byte of 0x80 can be used to make a value of
less then 80 and we then subtract 80 from it as required by the OID
encoding rules.  Due to the use of an unsigned integer this results in a
pretty long value which won't fit anymore into the allocated buffer.

Impact
======

A remote attacker can cause a denial of service by sending a specially
crafted S/MIME message or ECC based OpenPGP data.

References
==========

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9087
http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html
http://seclists.org/oss-sec/2014/q4/801

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20141128/593e9201/attachment.bin>