oss-sec mailing list archives

Re: CVE request: double-free vulnerability in logsurfer

From: Marcus Meissner <meissner () suse de>
Date: Mon, 17 Oct 2011 12:07:38 +0200

On Mon, Oct 17, 2011 at 12:02:29PM +0200, Timo Warns wrote:

Gregor Kopf of Recurity Labs GmbH found a double-free vulnerability in
Logsurfer affecting the function prepare_exec(). The vulnerability is caused by
an insufficient treatment of an error condition that is returned by the
function get_word() when it is unable to correctly parse its input.

The following versions of logsurfer are affected:

 Logsurfer 1.5b and previous versions
 Logsurfer+ 1.7 and previous versions

A patch is available at 
http://logsurfer.git.sourceforge.net/git/gitweb.cgi?p=logsurfer/logsurfer;a=commit;h=07983748da9ea3d4954b80f02fed692fe21b1134


How can this be exploited?

It seems to happen in the argument handling and I doubt an attacker can inject arguments?

Ciao, Marcus

Current thread:

CVE request: double-free vulnerability in logsurfer Timo Warns (Oct 17)
- Re: CVE request: double-free vulnerability in logsurfer Marcus Meissner (Oct 17)
  - Re: CVE request: double-free vulnerability in logsurfer Timo Warns (Oct 17)
    - Re: CVE request: double-free vulnerability in logsurfer Josh Bressers (Oct 18)