Moderate to low-risk security issue found in Clearsilver python bindings
Brandon Long <[email protected]> Tue, 29 Nov 2011 10:13:00 -0800
| Newsgroups | gmane.text.clearsilver.general |
|---|---|
| Message-ID | <CAA6MhGsE8VZXaEAQY5Y3WyGw0S8+u2tbSs5EjJO_YQrQU03Otg@mail.gmail.com> |
--EOZ4uq4ELrvxjyfDRCB4kBYgt933awg66r2LwAu
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
This issue was given identifier CVE-2011-4357.
This issue only affects the python wrapper for ClearSilver.
In the CGI.error method from the neo_cgi module, the string is passed
as the format parameter to the underlying cgi_error function which
takes printf-style arguments. This means that including a % format
character in that string can result in garbage being read from the
stack.
Apparently this is enough to cause some security issues, I'm not
qualified to say how vulnerable this particular leak might be. Redhat
classified it as moderate.
From my experience, the usage of this method is pretty uncommon, I
couldn't find any use of it in any of the code that I have, nor in any
of the code I could find in Google's Code Search. That said, you
should check your own code and verify that you either don't use this
method, or that you don't send user input to it, or that you patch
your copy of clearsilver to fix this issue.
A change has been committed to the source svn for this bug, available here:
http://code.google.com/p/clearsilver/source/detail?r=919
At least the neo_cgi.c part of that patch should patch cleanly on most
0.10.x versions of clearsilver. The fix will also be included in the
upcoming 0.11.x release.
This bug was found by the debian package maintainers, though no one
felt the need to email me or this group with the information. Thanks
to Google Alerts for alerting me to the issue. See this debian bug
for details: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649322
Brandon
--EOZ4uq4ELrvxjyfDRCB4kBYgt933awg66r2LwAu
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
</head>
<body style="background-color: #fff;">
<span style="display:none"> </span>
<!--~-|**|PrettyHtmlStartT|**|-~-->
<div id="ygrp-mlmsg" style="position:relative;">
<div id="ygrp-msg" style="z-index: 1;">
<!--~-|**|PrettyHtmlEndT|**|-~-->
<div id="ygrp-text" >
<p>This issue was given identifier CVE-2011-4357.<br>
<br>
This issue only affects the python wrapper for ClearSilver.<br>
<br>
In the CGI.error method from the neo_cgi module, the string is passed<br>
as the format parameter to the underlying cgi_error function which<br>
takes printf-style arguments. This means that including a % format<br>
character in that string can result in garbage being read from the<br>
stack.<br>
<br>
Apparently this is enough to cause some security issues, I'm not<br>
qualified to say how vulnerable this particular leak might be. Redhat<br>
classified it as moderate.<br>
<br>
From my experience, the usage of this method is pretty uncommon, I<br>
couldn't find any use of it in any of the code that I have, nor in any<br>
of the code I could find in Google's Code Search. That said, you<br>
should check your own code and verify that you either don't use this<br>
method, or that you don't send user input to it, or that you patch<br>
your copy of clearsilver to fix this issue.<br>
<br>
A change has been committed to the source svn for this bug, available here:<br>
<br>
<a href="http://code.google.com/p/clearsilver/source/detail?r=919">http://code.google.com/p/clearsilver/source/detail?r=919</a><br>
<br>
At least the neo_cgi.c part of that patch should patch cleanly on most<br>
0.10.x versions of clearsilver. The fix will also be included in the<br>
upcoming 0.11.x release.<br>
<br>
This bug was found by the debian package maintainers, though no one<br>
felt the need to email me or this group with the information. Thanks<br>
to Google Alerts for alerting me to the issue. See this debian bug<br>
for details: <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649322">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649322</a><br>
<br>
Brandon<br>
</p>
</div>
<!--~-|**|PrettyHtmlStart|**|-~-->
<div style="color: #fff; height: 0;">__._,_.___</div>
<div id="ygrp-actbar" style="clear: both; margin-bottom: 10px; white-space: nowrap; color: #666; padding-top: 15px;">
<div>
<a href="mailto:[email protected]?subject=Re%3A%20Moderate%20to%20low-risk%20security%20issue%20found%20in%20Clearsilver%20python%20bindings" style="margin-right: 0; padding-right: 0;">
Reply to <span style="font-weight: 700;">sender</span></a> |
<a href="mailto:[email protected]?subject=Re%3A%20Moderate%20to%20low-risk%20security%20issue%20found%20in%20Clearsilver%20python%20bindings">
Reply to <span style="font-weight: 700;">group</span></a> |
<a href="http://groups.yahoo.com/group/ClearSilver/post;_ylc=X3oDMTJwY2I3aW9iBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBG1zZ0lkAzE0MjIEc2VjA2Z0cgRzbGsDcnBseQRzdGltZQMxMzIyNTkwMzg1?act=reply&messageNum=1422">Reply <span style="font-weight: 700;">via web post</span></a> |
<a href="http://groups.yahoo.com/group/ClearSilver/post;_ylc=X3oDMTJlOGZxZWhtBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTMyMjU5MDM4NQ--" style="font-weight: 700;">Start a New Topic</a>
</div>
<a href="http://groups.yahoo.com/group/ClearSilver/message/1422;_ylc=X3oDMTM0bzEyYzliBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBG1zZ0lkAzE0MjIEc2VjA2Z0cgRzbGsDdnRwYwRzdGltZQMxMzIyNTkwMzg1BHRwY0lkAzE0MjI-">Messages in this topic</a>
(<span style="font-weight: 700;">1</span>)
</div>
<!------- Start Nav Bar ------>
<!-- |**|begin egp html banner|**| -->
<div id="ygrp-vital" style="background-color: #e0ecee; font-family: Verdana; font-size: 10px; margin-bottom: 10px; padding: 10px;">
<span id="vithd" style="font-weight: bold; color: #333; text-transform: uppercase; ">Recent Activity:</span>
<ul style="list-style-type: none; margin: 0; padding: 0; display: inline;">
</ul>
<div style="clear: both; padding-top: 2px; color: #1e66ae;">
<a href="http://groups.yahoo.com/group/ClearSilver;_ylc=X3oDMTJla29ydWNmBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwN2dGwEc2xrA3ZnaHAEc3RpbWUDMTMyMjU5MDM4NQ--" style="text-decoration: none;">Visit Your Group</a>
</div>
</div>
<div id="ygrp-mkp" style="border: 1px solid #d8d8d8; clear: both; float: left; font-family: Arial; margin: 5px 0 10px 0; padding: 0 10px;">
<div id="hd" style="color: #628c2a; font-size: 85%; font-weight: 700; line-height: 122%; margin: 10px 0;">MARKETPLACE</div>
<div id="ads" style="margin-bottom: 10px;">
<div class="ad" style="color: #628C2A; font-family: Arial; font-weight: 700; padding: 0 0;">
<p><a href="http://global.ard.yahoo.com/SIG=15oaqh58q/M=493064.14543979.14562481.13298430/D=groups/S=1707281942:MKP1/Y=YAHOO/EXP=1322597585/L=c8d90f00-1ab5-11e1-930c-7b31bb55ebf4/B=i3_KL0oGYr4-/J=1322590385914519/K=zGYyVUQGwRV_1f_myXSCBg/A=6060255/R=0/SIG=1194m4keh/*http://us.toolbar.yahoo.com/?.cpdl=grpj">Stay on top of your group activity without leaving the page you're on - Get the Yahoo! Toolbar now.</a></p> <script language=javascript>
if(window.yzq_d==null)window.yzq_d=new Object();
window.yzq_d['i3_KL0oGYr4-']='&U=13ccji4dr%2fN%3di3_KL0oGYr4-%2fC%3d493064.14543979.14562481.13298430%2fD%3dMKP1%2fB%3d6060255%2fV%3d1';
</script><noscript><img width=1 height=1 alt="" src="http://us.bc.yahoo.com/b?P=c8d90f00-1ab5-11e1-930c-7b31bb55ebf4&T=1d5p2ofok%2fX%3d1322590385%2fE%3d1707281942%2fR%3dgroups%2fK%3d5%2fV%3d2.1%2fW%3dH%2fY%3dYAHOO%2fF%3d1931539565%2fH%3dY29udGVudD0iR287UG9kY2FzdHM7V2lkZ2V0cztGbGlja3I7WWFob29fU2VhcmNoX01hcmtldGluZztGaW5hbmNlO0Jvb2ttYXJrO01lc3NhZ2VfQm9hcmRzO0NhbGVuZGFyO0V2ZW50czsiIGRpc2FibGVzaHVmZmxpbmc9IjEiIHNlcnZlSWQ9ImM4ZDkwZjAwLTFhYjUtMTFlMS05MzBjLTdiMzFiYjU1ZWJmNCIgc2l0ZUlkPSI0NDUyNTUxIiB0U3RtcD0iMTMyMjU5MDM4NTg4OTk0MSIg%2fQ%3d-1%2fS%3d1%2fJ%3d693E8962&U=13ccji4dr%2fN%3di3_KL0oGYr4-%2fC%3d493064.14543979.14562481.13298430%2fD%3dMKP1%2fB%3d6060255%2fV%3d1"></noscript><!--QYZ ,;;MKP1;1707281942;2;--> </div>
</div>
</div>
<div id="ft" style="font-family: Arial; font-size: 11px; margin-top: 5px; padding: 0 2px 0 0; clear: both;">
<a href="http://groups.yahoo.com/;_ylc=X3oDMTJkZTZ0NnRwBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA2dmcARzdGltZQMxMzIyNTkwMzg1" style="float: left;"><img src="http://l.yimg.com/a/i/us/yg/logo/us.gif" height="15" width="137" alt="Yahoo! Groups" style="border: 0;"/></a>
<div style="color: #747575; float: right;">Switch to: <a href="mailto:[email protected]?subject=Change Delivery Format: Traditional" style="text-decoration: none;">Text-Only</a>, <a href="mailto:[email protected]?subject=Email Delivery: Digest" class="margin-rt" style="text-decoration: none;">Daily Digest</a> • <a href="mailto:[email protected]?subject=Unsubscribe" style="text-decoration: none;">Unsubscribe</a> • <a href="http://docs.yahoo.com/info/terms/" style="text-decoration: none;">Terms of Use</a></div>
</div>
<!-- |**|end egp html banner|**| -->
</div> <!-- ygrp-msg -->
<!-- Sponsor -->
<!-- |**|begin egp html banner|**| -->
<div id="ygrp-sponsor" style="width:160px; float:right; clear:none; margin:0 0 25px 0; background: #fff;">
<!-- Start Recommendations -->
<div id="ygrp-reco">
</div>
<!-- End Recommendations -->
</div> <!-- |**|end egp html banner|**| -->
<div style="clear:both; color: #FFF; font-size:1px;">.</div>
</div>
<img src="http://geo.yahoo.com/serv?s=97359714/grpId=3564137/grpspId=1707281942/msgId=1422/stime=1322590385/nc1=5741398/nc2=4507179/nc3=3848643" width="1" height="1"> <br>
<div style="color: #fff; height: 0;">__,_._,___</div>
<!--~-|**|PrettyHtmlEnd|**|-~-->
</body>
<!--~-|**|PrettyHtmlStart|**|-~-->
<head>
<style type="text/css">
<!--
#ygrp-mkp {
border: 1px solid #d8d8d8;
font-family: Arial;
margin: 10px 0;
padding: 0 10px;
}
#ygrp-mkp hr {
border: 1px solid #d8d8d8;
}
#ygrp-mkp #hd {
color: #628c2a;
font-size: 85%;
font-weight: 700;
line-height: 122%;
margin: 10px 0;
}
#ygrp-mkp #ads {
margin-bottom: 10px;
}
#ygrp-mkp .ad {
padding: 0 0;
}
#ygrp-mkp .ad p {
margin: 0;
}
#ygrp-mkp .ad a {
color: #0000ff;
text-decoration: none;
}
#ygrp-sponsor #ygrp-lc {
font-family: Arial;
}
#ygrp-sponsor #ygrp-lc #hd {
margin: 10px 0px;
font-weight: 700;
font-size: 78%;
line-height: 122%;
}
#ygrp-sponsor #ygrp-lc .ad {
margin-bottom: 10px;
padding: 0 0;
}
a {
color: #1e66ae;
}
#actions {
font-family: Verdana;
font-size: 11px;
padding: 10px 0;
}
#activity {
background-color: #e0ecee;
float: left;
font-family: Verdana;
font-size: 10px;
padding: 10px;
}
#activity span {
font-weight: 700;
}
#activity span:first-child {
text-transform: uppercase;
}
#activity span a {
color: #5085b6;
text-decoration: none;
}
#activity span span {
color: #ff7900;
}
#activity span .underline {
text-decoration: underline;
}
.attach {
clear: both;
display: table;
font-family: Arial;
font-size: 12px;
padding: 10px 0;
width: 400px;
}
.attach div a {
text-decoration: none;
}
.attach img {
border: none;
padding-right: 5px;
}
.attach label {
display: block;
margin-bottom: 5px;
}
.attach label a {
text-decoration: none;
}
blockquote {
margin: 0 0 0 4px;
}
.bold {
font-family: Arial;
font-size: 13px;
font-weight: 700;
}
.bold a {
text-decoration: none;
}
dd.last p a {
font-family: Verdana;
font-weight: 700;
}
dd.last p span {
margin-right: 10px;
font-family: Verdana;
font-weight: 700;
}
dd.last p span.yshortcuts {
margin-right: 0;
}
div.attach-table div div a {
text-decoration: none;
}
div.attach-table {
width: 400px;
}
div.file-title a, div.file-title a:active, div.file-title a:hover, div.file-title a:visited {
text-decoration: none;
}
div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div.photo-title a:visited {
text-decoration: none;
}
div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts {
font-family: Verdana;
font-size: 10px;
font-weight: normal;
}
.green {
color: #628c2a;
}
.MsoNormal {
margin: 0 0 0 0;
}
o {
font-size: 0;
}
#photos div {
float: left;
width: 72px;
}
#photos div div {
border: 1px solid #666666;
height: 62px;
overflow: hidden;
width: 62px;
}
#photos div label {
color: #666666;
font-size: 10px;
overflow: hidden;
text-align: center;
white-space: nowrap;
width: 64px;
}
#reco-category {
font-size: 77%;
}
#reco-desc {
font-size: 77%;
}
.replbq {
margin: 4px;
}
#ygrp-actbar div a:first-child {
/* border-right: 0px solid #000;*/
margin-right: 2px;
padding-right: 5px;
}
#ygrp-mlmsg {
font-size: 13px;
font-family: Arial, helvetica,clean, sans-serif;
*font-size: small;
*font: x-small;
}
#ygrp-mlmsg table {
font-size: inherit;
font: 100%;
}
#ygrp-mlmsg select, input, textarea {
font: 99% Arial, Helvetica, clean, sans-serif;
}
#ygrp-mlmsg pre, code {
font:115% monospace;
*font-size:100%;
}
#ygrp-mlmsg * {
line-height: 1.22em;
}
#ygrp-mlmsg #logo {
padding-bottom: 10px;
}
#ygrp-mlmsg a {
color: #1E66AE;
}
#ygrp-msg p a {
font-family: Verdana;
}
#ygrp-msg p#attach-count span {
color: #1E66AE;
font-weight: 700;
}
#ygrp-reco #reco-head {
color: #ff7900;
font-weight: 700;
}
#ygrp-reco {
margin-bottom: 20px;
padding: 0px;
}
#ygrp-sponsor #ov li a {
font-size: 130%;
text-decoration: none;
}
#ygrp-sponsor #ov li {
font-size: 77%;
list-style-type: square;
padding: 6px 0;
}
#ygrp-sponsor #ov ul {
margin: 0;
padding: 0 0 0 8px;
}
#ygrp-text {
font-family: Georgia;
}
#ygrp-text p {
margin: 0 0 1em 0;
}
#ygrp-text tt {
font-size: 120%;
}
#ygrp-vital ul li:last-child {
border-right: none !important;
}
-->
</style>
</head>
<!--~-|**|PrettyHtmlEnd|**|-~-->
</html>
<!-- end group email -->
--EOZ4uq4ELrvxjyfDRCB4kBYgt933awg66r2LwAu--