[UNIX] PostgreSQL to_ascii() Buffer Overflow Vulnerability
From: SecuriTeam (support_at_securiteam.com)
Date: 11/02/03
- Previous message: SecuriTeam: "[UNIX] Buffer Overflow in PostgreSQL's cash_words()"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 2 Nov 2003 19:05:44 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
PostgreSQL to_ascii() Buffer Overflow Vulnerability
------------------------------------------------------------------------
SUMMARY
PostgreSQL contains a buffer overflow vulnerability in its to_ascii()
function. The to_ascii() function is used to convert text from multibyte
encoding format to ASCII, and due to improper bounds checking and
unsigned/signed calculations a buffer overflow may occur.
DETAILS
Vulnerable systems:
* PostgreSQL version 7.2.x
* PostgreSQL version 7.3.1, 7.3.2, 7.3.3
Immune systems:
* PostgreSQL version 7.3.4
In line 66 of the ascii.c it can be clearly seen that:
for (x = src; x <= src_end; x++)
{
if (*x < 128)
*desc++ = *x;
The 'x' parameter runs from src to src_end (including), this means that an
off by one will occur.
Another problem that also resides in the code:
pg_to_ascii(
(unsigned char *) VARDATA(data), /* src
*/
VARDATA(data) + VARSIZE(data), /* src end
*/
(unsigned char *) VARDATA(data), /* desc
*/
enc); /* encoding */
The fact that VARDATA(data) + VARSIZE(data) is calculated, while their
types differ, could cause the number/pointer returned by this to point to
a negative number, allowing overwriting of arbitrary bytes in the memory
(the fix of course is to do a (unsigned char *) casting on the first
variable).
ADDITIONAL INFORMATION
The information has been provided by OpenPKG.
The vulnerability has been discovered by Guido Notari.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[UNIX] Buffer Overflow in PostgreSQL's cash_words()"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
