Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.

This update fixes a heap-based buffer overflow in HX_split() of libHX.
(CVE-2010-2947)

Update to libHX 3.6 fixing a buffer overflow in HX_split() :

  -     http://libhx.git.sourceforge.net/git/gitweb.cgi?p=libhx/     libhx;a=commitdiff;h=904a46f90d

pam_mount v2.5 (August 10 2010) =============================== Changes :

  - mount.crypt: fix incorrect processing of binary files in     keyfile passthrough

    - call mount.crypt by means of mount -t crypt (selinux),       same for umount

    - reorder the default path to search in /usr/local       first, then /usr, /

    - config: add missing fd0ssh command to restore volumes       using ssh

    - ofl is now run as a separate process (selinux policy       simplification)

libHX v3.6 (August 16 2010) =========================== Fixed :

  - bitmap: set/clear/test had no effect due to wrong type     selection

    - bitmap: avoid left-shift larger than type on 64-bit

    - string: fixed buffer overflow in HX_split when too few       fields were present in the input

libHX 3.5 (August 01 2010) ========================== Fixed :

  - format2: failure to skip escaped char in '%(echo foo\     bar)' was corrected

    - proc: properly check for HXPROC_STDx--HXPROC_STDx_NULL       overlap

    - strquote: do not cause allocation with invalid format       numbers Enhancements :

  - format2: add the %(exec) function

    - format2: add the %(shell) function

    - format2: security feature for %(exec) and %(shell)

    - format2: add the %(snl) function

    - string: HX_strquote gained HXQUOTE_LDAPFLT (LDAP       search filter) support

    - string: HX_strquote gained HXQUOTE_LDAPRDN (LDAP       relative DN) support Changes :

  - format1: removed older formatter in favor of format2

    - format2: add check for empty key

    - format2: function-specific delimiters

    - format2: do nest-counting even with normal parentheses

    - format2: check for zero-argument function calls

    - hashmap: do not needlessy change TID when no reshape       was done

    - string: HX_basename (the fast variant) now recognizes       the root directory

    - string: HX_basename now returns the trailing component       with slashes instead of everything after the last       slash (which may have been nothing)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libHX incorrectly handled certain parameters to the HX_split function. An attacker could use this flaw to cause a denial of service or possibly execute arbitrary code with the privileges of the user.

The default compiler options for affected releases should reduce the vulnerability to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to libHX 3.6 fixing a buffer overflow in HX_split(): * http://libhx.gi t.sourceforge.net/git/gitweb.cgi?p=libhx/libhx;a=commitdiff;h=904a46f9 0d pam_mount v2.5 (August 10 2010) =============================== Changes: - mount.crypt: fix incorrect processing of binary files in keyfile passthrough - call mount.crypt by means of mount -t crypt (selinux), same for umount - reorder the default path to search in /usr/local first, then /usr, / - config: add missing fd0ssh command to restore volumes using ssh - ofl is now run as a separate process (selinux policy simplification) libHX v3.6 (August 16 2010) =========================== Fixed: - bitmap: set/clear/test had no effect due to wrong type selection - bitmap: avoid left-shift larger than type on 64-bit

  - string: fixed buffer overflow in HX_split when too few     fields were present in the input libHX 3.5 (August 01     2010) ========================== Fixed: - format2:
    failure to skip escaped char in '%(echo foo\ bar)' was     corrected - proc: properly check for     HXPROC_STDx--HXPROC_STDx_NULL overlap - strquote: do not     cause allocation with invalid format numbers     Enhancements: - format2: add the %(exec) function -     format2: add the %(shell) function - format2: security     feature for %(exec) and %(shell) - format2: add the     %(snl) function - string: HX_strquote gained     HXQUOTE_LDAPFLT (LDAP search filter) support - string:
    HX_strquote gained HXQUOTE_LDAPRDN (LDAP relative DN)     support Changes: - format1: removed older formatter in     favor of format2 - format2: add check for empty key -     format2: function-specific delimiters - format2: do     nest-counting even with normal parentheses - format2:
    check for zero-argument function calls

  - hashmap: do not needlessy change TID when no reshape was     done - string: HX_basename (the fast variant) now     recognizes the root directory - string: HX_basename now     returns the trailing component with slashes instead of     everything after the last slash (which may have been     nothing)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in libHX :

Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields (CVE-2010-2947).

The updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
75581	openSUSE Security Update : libHX22 (openSUSE-SU-2010:0723-1)	Nessus	SuSE Local Security Checks	critical
50928	SuSE 11 / 11.1 Security Update : libHX13 (SAT Patch Numbers 2979 / 2980)	Nessus	SuSE Local Security Checks	critical
50389	Fedora 14 : libHX-3.6-1.fc14 / pam_mount-2.5-1.fc14 (2010-12950)	Nessus	Fedora Local Security Checks	critical
49976	openSUSE Security Update : libHX18 (openSUSE-SU-2010:0723-1)	Nessus	SuSE Local Security Checks	critical
49975	openSUSE Security Update : libHX13 (openSUSE-SU-2010:0723-1)	Nessus	SuSE Local Security Checks	critical
49763	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : libhx vulnerability (USN-994-1)	Nessus	Ubuntu Local Security Checks	critical
49106	Fedora 12 : libHX-3.6-1.fc12 / pam_mount-2.5-1.fc12 (2010-13155)	Nessus	Fedora Local Security Checks	critical
49105	Fedora 13 : libHX-3.6-1.fc13 / pam_mount-2.5-1.fc13 (2010-13127)	Nessus	Fedora Local Security Checks	critical
48933	Mandriva Linux Security Advisory : libHX (MDVSA-2010:165)	Nessus	Mandriva Local Security Checks	critical

Detections

Analytics

CVE-2010-2947

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical