Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to be allocated than expected.

The remote host is affected by the vulnerability described in GLSA-202105-04 (Boost: Buffer overflow)

    It was discovered that Boost incorrectly sanitized &lsquo;next_size&rsquo; and       &lsquo;max_size&rsquo; parameter in ordered_malloc() function when allocating       memory.
  Impact :

    A remote attacker could provide a specially crafted application-specific       file (requiring runtime memory allocation to be processed correctly),       that, when opened with an application using Boost C++ source libraries,       possibly resulting in execution of arbitrary code with the privileges of       the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to be allocated than expected. (CVE-2012-2677)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0668 advisory.

    [1.41.0-15]
    - Add in explicit dependences between some boost subpackages

    [1.41.0-14]
    - Build with -fno-strict-aliasing

    [1.41.0-13]
    - In Boost.Pool, be careful not to overflow allocated chunk size       (boost-1.41.0-pool.patch)

    [1.41.0-12]
    - Add an upstream patch that fixes computation of CRC in zlib streams.
    - Resolves: #707624

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated boost packages fix security vulnerability :

A security flaw was found in the way ordered_malloc() routine implementation in Boost, the free peer-reviewed portable C++ source libraries, performed 'next-size' and 'max_size' parameters sanitization, when allocating memory. If an application, using the Boost C++ source libraries for memory allocation, was missing application-level checks for safety of 'next_size' and 'max_size' values, a remote attacker could provide a specially crafted application-specific file (requiring runtime memory allocation it to be processed correctly) that, when opened would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application (CVE-2012-2677).

Boost.Locale library in Boost 1.48 to 1.52 including has a security flaw (CVE-2013-0252): boost::locale::utf::utf_traits accepted some invalid UTF-8 sequences. Applications that used these functions for UTF-8 input validation could expose themselves to security threats as invalid UTF-8 sequece would be considered as valid.

The package has been patched to fix above security flaw.

A flaw was found in the way the ordered_malloc() routine in Boost sanitized the 'next_size' and 'max_size' parameters when allocating memory. If an application used the Boost C++ libraries for memory allocation, and performed memory allocation based on user-supplied input, an attacker could use this flaw to crash the application or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-2677)

Updated boost packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The boost packages provide free, peer-reviewed, portable C++ source libraries with emphasis on libraries which work well with the C++ Standard Library.

A flaw was found in the way the ordered_malloc() routine in Boost sanitized the 'next_size' and 'max_size' parameters when allocating memory. If an application used the Boost C++ libraries for memory allocation, and performed memory allocation based on user-supplied input, an attacker could use this flaw to crash the application or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-2677)

All users of boost are advised to upgrade to these updated packages, which contain a backported patch to fix this issue.

The following issue has been fixed :

  - boost::pool's ordered_malloc could have overflowed when     calculating the allocation size. (CVE-2012-2677)

Two problems have been fixed in the boost library :

  - boost::pool's ordered_malloc could have overflowed when     calculating the allocation size. (CVE-2012-2677)

  - fully qualify the the     boost::date_time::dst_adjustment_offsets (non security).

- This update fixes a bug in Boost.Pool, which could under     certain circumstances overflow allocated chunk size.
    This could have security implications for applications     that use Boost pool without sanitizing pool parameters.

    - Add a sub-package boost-math with math-related bits       from Boost.TR1. This was left out by mistake.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- This update fixes a bug in Boost.Pool, which could under     certain circumstances overflow allocated chunk size.
    This could have security implications for applications     that use Boost pool without sanitizing pool parameters.

    - Boost.Locale library now contains backend code, which       was left out before by mistake.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
150011	GLSA-202105-04 : Boost: Buffer overflow	Nessus	Gentoo Local Security Checks	critical
85954	F5 Networks BIG-IP : Boost memory allocator vulnerability (K16946)	Nessus	F5 Networks Local Security Checks	medium
68794	Oracle Linux 5 / 6 : boost (ELSA-2013-0668)	Nessus	Oracle Linux Local Security Checks	critical
66079	Mandriva Linux Security Advisory : boost (MDVSA-2013:065)	Nessus	Mandriva Local Security Checks	medium
65653	Scientific Linux Security Update : boost on SL5.x, SL6.x i386/x86_64 (20130321)	Nessus	Scientific Linux Local Security Checks	medium
65651	RHEL 5 / 6 : boost (RHSA-2013:0668)	Nessus	Red Hat Local Security Checks	medium
65644	CentOS 5 / 6 : boost (CESA-2013:0668)	Nessus	CentOS Local Security Checks	medium
64117	SuSE 11.1 Security Update : boost (SAT Patch Number 6507)	Nessus	SuSE Local Security Checks	medium
59983	SuSE 10 Security Update : boost (ZYPP Patch Number 8210)	Nessus	SuSE Local Security Checks	medium
59840	Fedora 16 : boost-1.47.0-7.fc16 (2012-9029)	Nessus	Fedora Local Security Checks	medium
59745	Fedora 17 : boost-1.48.0-13.fc17 (2012-9818)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-2677

critical

Tenable Plugins

critical

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium