CVE-2009-1633 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Severity

71%

Complexity

86%

Confidentiality

115%

Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c; or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.

Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c; or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.

CVSS 2.0 Base Score 7.1. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C).

Demo Examples

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119

This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.


               
}
strcpy(hostname, hp->h_name);/*routine that ensures user_supplied_addr is in the right format for conversion */

This function allocates a buffer of 64 bytes to store the hostname, however there is no guarantee that the hostname will not be larger than 64 bytes. If an attacker specifies an address which resolves to a very large hostname, then we may overwrite sensitive data or even relinquish control flow to the attacker.

Note that this example also contains an unchecked return value (CWE-252) that can lead to a NULL pointer dereference (CWE-476).

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119

This example applies an encoding procedure to an input string and stores it into a buffer.


               
}
return dst_buf;
die("user string too long, die evil hacker!");
else dst_buf[dst_index++] = user_supplied_string[i];
dst_buf[dst_index++] = ';';
/* encode to < */

The programmer attempts to encode the ampersand character in the user-controlled string, however the length of the string is validated before the encoding procedure is applied. Furthermore, the programmer assumes encoding expansion will only expand a given character by a factor of 4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure expands the string it is possible to overflow the destination buffer if the attacker provides a string of many ampersands.

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119

The following example asks a user for an offset into an array to select an item.


               
}
printf("You selected %s\n", items[index-1]);

The programmer allows the user to specify which element in the list to select, however an attacker can provide an out-of-bounds offset, resulting in a buffer over-read (CWE-126).

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119

In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the method


               
}
return value;// check that the array index is less than the maximum// length of the array
value = array[index];// get the value at the specified index of the array
// if array index is invalid then output error message// and return value indicating error
value = -1;

However, this method only verifies that the given array index is less than the maximum length of the array but does not check for the minimum value (CWE-839). This will allow a negative value to be accepted as the input array index, which will result in a out of bounds read (CWE-125) and may allow access to sensitive memory. The input array index should be checked to verify that is within the maximum and minimum range required for the array (CWE-129). In this example the if statement should be modified to include a minimum range check, as shown below.


               
...// check that the array index is within the correct// range of values for the array

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119

Windows provides the _mbs family of functions to perform various operations on multibyte strings. When these functions are passed a malformed multibyte string, such as a string containing a valid leading byte followed by a single null byte, they can read or write past the end of the string buffer causing a buffer overflow. The following functions all pose a risk of buffer overflow: _mbsinc _mbsdec _mbsncat _mbsncpy _mbsnextc _mbsnset _mbsrev _mbsset _mbsstr _mbstok _mbccpy _mbslen

Overview

Type

Linux

First reported 16 years ago

2009-05-28 20:30:00

Last updated 6 years ago

2018-11-08 20:29:00

Affected Software

Linux Kernel

Debian GNU/Linux 4.0

4.0

Debian GNU/Linux 5.0

5.0

Canonical Ubuntu Linux 6.06 LTS (Long-Term Support)

6.06

Canonical Ubuntu Linux 8.04 LTS (Long-Term Support)

8.04

Canonical Ubuntu Linux 8.10

8.10

Canonical Ubuntu Linux 9.04

9.04

References

http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commit;h=7b0c8fcff47a885743125dd843db64af41af5a61

Patch, Vendor Advisory

http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commit;h=968460ebd8006d55661dec0fb86712b40d71c413

Patch, Vendor Advisory

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=27b87fe52baba0a55e9723030e76fce94fabcea4

Patch, Vendor Advisory

SUSE-SA:2009:054

Mailing List, Third Party Advisory

SUSE-SA:2009:056

Mailing List, Third Party Advisory

SUSE-SA:2010:012

Mailing List, Third Party Advisory

[oss-security] 20090429 Re: CVE request? buffer overflow in CIFS in 2.6.*

Mailing List, Third Party Advisory

[oss-security] 20090429 Re: CVE request? buffer overflow in CIFS in 2.6.*

Mailing List, Third Party Advisory

35217

Third Party Advisory

35226

Third Party Advisory

35298

Third Party Advisory

35656

Third Party Advisory

35847

Third Party Advisory

36051

Third Party Advisory

36327

Third Party Advisory

37351

Third Party Advisory

37471

Third Party Advisory

http://wiki.rpath.com/Advisories:rPSA-2009-0111

Broken Link

DSA-1809

Third Party Advisory

DSA-1844

Third Party Advisory

DSA-1865

Third Party Advisory

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29.4

Vendor Advisory

MDVSA-2009:148

Third Party Advisory

[oss-security] 20090514 Update - Re: CVE request? buffer overflow in CIFS in 2.6.*

Mailing List, Patch, Third Party Advisory

[oss-security] 20090514 Re: Update - Re: CVE request? buffer overflow in CIFS in 2.6.*

Mailing List, Patch, Third Party Advisory

[oss-security] 20090515 Re: Re: Update - Re: CVE request? buffer overflow in CIFS in 2.6.*

Mailing List, Patch, Third Party Advisory

RHSA-2009:1157

Third Party Advisory

20090724 rPSA-2009-0111-1 kernel

Third Party Advisory, VDB Entry

20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components

Third Party Advisory, VDB Entry

34612

Third Party Advisory, VDB Entry

USN-793-1

Third Party Advisory

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Third Party Advisory

ADV-2009-3316

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=496572

Issue Tracking, Patch, Third Party Advisory

oval:org.mitre.oval:def:8588

Third Party Advisory

oval:org.mitre.oval:def:9525

Third Party Advisory

FEDORA-2009-5356

Patch, Third Party Advisory

FEDORA-2009-5383

Third Party Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.