oss-sec mailing list archives



CVE Request for Denial of Service in pacman 5.0.1

The package manager of Arch Linux, pacman, is vulnerable to a denial of service attack based on signature files. This issue is located in libalpm and therefore affects any other frontend of it, too. A malicious signature file can trigger an out of bondary read on 32 and 64 bit systems, but also leads to an endless loop on 32 bit system. While an endless loop on itself is no security issue per-se, such a crafted file might trick the end-user to disable signature verification to get his updates installed. This, on the other hand, would open up possibilities for malicious packages to be installed. Therefore, this DoS can be considered a stepping stone towards a system attack. Proof of concept (signature verification must be enabled): $ uname -m i686 $ PKG=package-1.0.tar.xz $ touch $PKG $ echo "iQEcBAABCAAGBQJXTxJiAAr/////+wA=" | base64 -d - > $PKG.sig $ sudo pacman -U $PKG _ The out of boundary access can be used to send 8 bytes inside the address space of a root-running program to a keyserver, as long as the byte in front of them is 0x10. This issue with a patch has been reported upstream. [1] Can you assign a CVE-ID for this? --T. [1] https://lists.archlinux.org/pipermail/pacman-dev/2016-June/021148.html

By Date By Thread

Current thread: