Dear list,
as discovered by Felix von Leitner (http://blog.fefe.de/?ts=b72905a8),
Linux kernel patch 2.6.29.1 contains:
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3667,7 +3667,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
BCC(smb_buffer_response)) {
kfree(tcon->nativeFileSystem);
tcon->nativeFileSystem =
- kzalloc(length + 2, GFP_KERNEL);
+ kzalloc(2*(length + 1), GFP_KERNEL);
if (tcon->nativeFileSystem)
cifs_strfromUCS_le(
tcon->nativeFileSystem,
fixing a remotely exploitable buffer overflow vulnerability in the CIFS
protocol.
Neither the Linux kernel team, the CIFS maintainers nor any of the commercial
Linux distributors bothered to send out an advisory.
I'm at loss for words other than "irresponsible, arrogant assholes". Linux
2009 == Microsoft 2002.
Andreas
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
