Re: Linux ISO9660 handling flaws

• Previous message: GHC team: "possible SQL injection in Subdreamer"
• In reply to: Michal Zalewski: "Linux ISO9660 handling flaws"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Fri, 18 Mar 2005 02:46:03 +0300 (MSK)
To: Michal Zalewski <lcamtuf@dione.ids.pl>

On Thu, 17 Mar 2005, Michal Zalewski wrote:

> Good morning,
>
> There appears to be a fair number of kernel-level range checking flaws in
> ISO9660 filesystem handler (and Rock Ridge / Juliet extensions) in Linux
> up to and including 2.6.11. These bugs range from DoS conditions to
> potentially exploitable memory corruption - all this whenever a specially
> crafted filesystem is mounted or directories are examined.
>
> Most apparent flaws are expected to be fixed in Linux 2.6.12 (rc to show
> up by tomorrow or so), although, as per Linus words, "that code is
> horrid", and it may take some time to work out all the issues.
>
> The impact is not dramatic, but there are two obvious ways such flaws can
> be used to benefit remote attackers:
>
> 1) Bugs in removable media filesystems may be used to automatically
> compromise any system whose owner decided to examine a newly acquired
> CD-ROM, even if extreme caution is observed (that is, autorun is
> disabled, and no files are executed).
>
> 2) For all types of filesystems, such problems can be additionally used
> to subvert forensic analysis efforts. Disk images from compromised
> machine may infect forensic examiner's system and alter results,
> or simply render the machine unusable.
>
Is this issue 2.6.x-specific, or it applies to 2.4.x branch too? Could you
please provide more details?

-- 
    Sincerely Your, Dan.

• Previous message: GHC team: "possible SQL injection in Subdreamer"
• In reply to: Michal Zalewski: "Linux ISO9660 handling flaws"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]