• Welcome to OS2World OLD-STATIC-BACKUP Forum.
 

News:

This is an old OS2World backup forum for reference only. IT IS READ ONLY!!!

If you need help with OS/2 - eComStation visit http://www.os2world.com/forum

Main Menu

OS/2 REXX files could lead to a denial of service

Started by kim, 2007.06.11, 11:14:04

Previous topic - Next topic

kim

Okey, the subject wasn't totally fair - I know - but I thought this advisory was interesting since it seems that looking for OS2 Rexx files on a Mandriva system will crash the system! According the advisory, Mandriva Linux Security Update Advisory - file (MDKSA-2007:114):

The update to correct CVE-2007-1536 (MDKSA-2007:067), a buffer overflow
in the file_printf() function, introduced a new integer overflow as
reported by Colin Percival.  This flaw, if an atacker could trick a
user into running file on a specially crafted file, could possibly
lead to the execution of arbitrary code with the privileges of the
user running file (CVE-2007-2799).

As well, in file 4.20, flawed regular expressions to identify OS/2
REXX
files could lead to a denial of service via CPU consumption
(CVE-2007-2026).