<<< Date Index >>>     <<< Thread Index >>>

Re: Linux ISO9660 handling flaws



On Thu, 17 Mar 2005, Michal Zalewski wrote:

> Good morning,
> 
> There appears to be a fair number of kernel-level range checking flaws in
> ISO9660 filesystem handler (and Rock Ridge / Juliet extensions) in Linux
> up to and including 2.6.11. These bugs range from DoS conditions to
> potentially exploitable memory corruption - all this whenever a specially
> crafted filesystem is mounted or directories are examined.
> 
> Most apparent flaws are expected to be fixed in Linux 2.6.12 (rc to show
> up by tomorrow or so), although, as per Linus words, "that code is
> horrid", and it may take some time to work out all the issues.
> 
> The impact is not dramatic, but there are two obvious ways such flaws can
> be used to benefit remote attackers:
> 
>   1) Bugs in removable media filesystems may be used to automatically
>      compromise any system whose owner decided to examine a newly acquired
>      CD-ROM, even if extreme caution is observed (that is, autorun is
>      disabled, and no files are executed).
> 
>   2) For all types of filesystems, such problems can be additionally used
>      to subvert forensic analysis efforts. Disk images from compromised
>      machine may infect forensic examiner's system and alter results,
>      or simply render the machine unusable.
> 
Is this issue 2.6.x-specific, or it applies to 2.4.x branch too? Could you 
please provide more details?
-- 

    Sincerely Your, Dan.