Bug 12691

Summary:	cxxtools new security issue CVE-2013-7298
Product:	Mageia	Reporter:	Anssi Hannula <anssi.hannula>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	cmrisolde, sysadmin-bugs, tmb
Version:	4	Keywords:	Security, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/583136/
Whiteboard:	has_procedure MGA4-64-OK MGA4-32-OK advisory
Source RPM:	cxxtools	CVE:	CVE-2013-7298
Status comment:

Description Anssi Hannula 2014-02-09 19:56:43 CET

Advisory:
============
A flaw in cxxtools version 2.2 allows remote attackers to cause a denial of service (infinite recursion and crash) via an HTTP query that contains %% (double percent) characters (CVE-2013-7298).

This update fixes the vulnerability.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7298
============

Updated packages in mga4 core/updates_testing. mga3 is not affected.

Source packages:
cxxtools-2.2-2.1.mga4

Binary packages:
lib64cxxtools9-2.2-2.1.mga4
lib64cxxtools-devel-2.2-2.1.mga4

Comment 1 David Walser 2014-02-09 21:33:21 CET

Will you fix this for Mageia 3 as well?

David Walser 2014-02-09 21:35:01 CET

Whiteboard: (none) => feedback

Comment 2 Anssi Hannula 2014-02-09 21:40:28 CET

From description: "mga3 is not affected."

Whiteboard: feedback => (none)

Comment 3 David Walser 2014-02-09 21:50:48 CET

Oh sorry, I missed that.  All of the outside references I looked at said versions before 2.2.1 were affected.  Where did you determine that?

Summary: cxxtools CVE-2013-7298 (mga4) => cxxtools new security issue CVE-2013-7298

Comment 4 Anssi Hannula 2014-02-09 21:53:20 CET

The code was very different pre-2.2, and Debian handler wasn't able to reproduce: http://comments.gmane.org/gmane.linux.debian.devel.secure-testing.cvs/26659

David Walser 2014-02-10 02:41:24 CET

Severity: normal => major

Comment 5 claire robinson 2014-02-12 18:18:50 CET

libcxxtools is used by tntnet (bug 12616) so both can be tested together

claire robinson 2014-02-12 18:19:07 CET

Whiteboard: (none) => has_procedure

Manuel Hiebel 2014-02-13 23:21:02 CET

Whiteboard: has_procedure => has_procedure MGA4-64-OK

Comment 6 Carolyn Rowse 2014-02-15 20:29:08 CET

Tested Mga4 32-bit with tntnet, nothing unexpected encountered.

Update validated.

See Description for advisory.

SRPM: cxxtools-2.2-2.1.mga4.src.rpm

Could sysadmin please push from core/updates_testing to core/updates.

Thank you.

Keywords: (none) => validated_update
CC: (none) => isolde, sysadmin-bugs
Whiteboard: has_procedure MGA4-64-OK => has_procedure MGA4-64-OK MGA4-32-OK

Comment 7 Thomas Backlund 2014-02-16 14:46:38 CET

Update pushed:
http://advisories.mageia.org/MGASA-2014-0073.html

Status: ASSIGNED => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED
Whiteboard: has_procedure MGA4-64-OK MGA4-32-OK => has_procedure MGA4-64-OK MGA4-32-OK advisory

David Walser 2014-02-18 17:45:20 CET

URL: (none) => http://lwn.net/Vulnerabilities/583136/