OS2World OLD-STATIC-BACKUP Forum

OS/2 - SIGs => Security => Topic started by: kim on 2007.06.11, 11:14:04

Title: OS/2 REXX files could lead to a denial of service
Post by: kim on 2007.06.11, 11:14:04
Okey, the subject wasn't totally fair - I know - but I thought this advisory was interesting since it seems that looking for OS2 Rexx files on a Mandriva system will crash the system! According the advisory, Mandriva Linux Security Update Advisory - file (MDKSA-2007:114):

The update to correct CVE-2007-1536 (MDKSA-2007:067), a buffer overflow
in the file_printf() function, introduced a new integer overflow as
reported by Colin Percival.  This flaw, if an atacker could trick a
user into running file on a specially crafted file, could possibly
lead to the execution of arbitrary code with the privileges of the
user running file (CVE-2007-2799).

As well, in file 4.20, flawed regular expressions to identify OS/2
REXX
files could lead to a denial of service via CPU consumption
(CVE-2007-2026).