Bug 13956

Summary:	icecream new security issue CVE-2014-4607
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	davidwhodgins, sysadmin-bugs, wilcal.int
Version:	4	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/604237/
Whiteboard:	MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK advisory
Source RPM:	icecream-1.0.0-3.mga4.src.rpm	CVE:
Status comment:
Bug Depends on:
Bug Blocks:	13943

Description David Walser 2014-08-20 20:35:52 CEST

icecream bundles minilzo, which is affected by the CVE-2014-4607 issue from the LZO library.

Patched packages uploaded for Mageia 3, Mageia 4, and Cauldron.

Advisory:
========================

Updated icecream packages fix security vulnerability:

An integer overflow in liblzo before 2.07 allows attackers to cause a denial
of service or possibly code execution in applications using performing LZO
decompression on a compressed payload from the attacker (CVE-2014-4607).

The icecream package is built with a bundled copy of minilzo, which is a
part of liblzo containing the vulnerable code.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4607
http://advisories.mageia.org/MGASA-2014-0290.html
========================

Updated packages in core/updates_testing:
========================
icecream-0.9.7-4.1.mga3
icecream-scheduler-0.9.7-4.1.mga3
icecream-devel-0.9.7-4.1.mga3
icecream-1.0.0-3.1.mga4
icecream-scheduler-1.0.0-3.1.mga4
icecream-devel-1.0.0-3.1.mga4

from SRPMS:
icecream-0.9.7-4.1.mga3.src.rpm
icecream-1.0.0-3.1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:

David Walser 2014-08-20 20:36:01 CEST

Blocks: (none) => 13943
Whiteboard: (none) => MGA3TOO

Comment 1 William Kenney 2014-08-24 19:18:22 CEST

In VirtualBox, M3, KDE, 32-bit

Package(s) under test:
icecream icecream-devel icecream-scheduler

default install of icecream icecream-devel icecream-scheduler

[root@localhost wilcal]# urpmi icecream
Package icecream-0.9.7-4.mga3.i586 is already installed
[root@localhost wilcal]# urpmi icecream-devel
Package icecream-devel-0.9.7-4.mga3.i586 is already installed
[root@localhost wilcal]# urpmi icecream-scheduler
Package icecream-scheduler-0.9.7-4.mga3.i586 is already installed

All packages installed correctly and without error messages

install icecream icecream-devel icecream-scheduler from updates_testing

[root@localhost wilcal]# urpmi icecream
Package icecream-0.9.7-4.1.mga3.i586 is already installed
[root@localhost wilcal]# urpmi icecream-devel
Package icecream-devel-0.9.7-4.1.mga3.i586 is already installed
[root@localhost wilcal]# urpmi icecream-scheduler
Package icecream-scheduler-0.9.7-4.1.mga3.i586 is already installed

All packages update correctly and without error messages

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64

CC: (none) => wilcal.int

Comment 2 William Kenney 2014-08-24 19:18:35 CEST

In VirtualBox, M3, KDE, 64-bit

Package(s) under test:
icecream icecream-devel icecream-scheduler

default install of icecream icecream-devel icecream-scheduler

[root@localhost wilcal]# urpmi icecream
Package icecream-0.9.7-4.mga3.x86_64 is already installed
[root@localhost wilcal]# urpmi icecream-devel
Package icecream-devel-0.9.7-4.mga3.x86_64 is already installed
[root@localhost wilcal]# urpmi icecream-scheduler
Package icecream-scheduler-0.9.7-4.mga3.x86_64 is already installed

All packages installed correctly and without error messages

install icecream icecream-devel icecream-scheduler from updates_testing

[root@localhost wilcal]# urpmi icecream
Package icecream-0.9.7-4.1.mga3.x86_64 is already installed
[root@localhost wilcal]# urpmi icecream-devel
Package icecream-devel-0.9.7-4.1.mga3.x86_64 is already installed
[root@localhost wilcal]# urpmi icecream-scheduler
Package icecream-scheduler-0.9.7-4.1.mga3.x86_64 is already installed

All packages update correctly and without error messages

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64

Comment 3 William Kenney 2014-08-24 19:18:49 CEST

In VirtualBox, M4, KDE, 32-bit

Package(s) under test:
icecream icecream-devel icecream-scheduler

default install of icecream icecream-devel icecream-scheduler

[root@localhost wilcal]# urpmi icecream
Package icecream-1.0.0-3.mga4.i586 is already installed
[root@localhost wilcal]# urpmi icecream-devel
Package icecream-devel-1.0.0-3.mga4.i586 is already installed
[root@localhost wilcal]# urpmi icecream-scheduler
Package icecream-scheduler-1.0.0-3.mga4.i586 is already installed

All packages installed correctly and without error messages

install icecream icecream-devel icecream-scheduler from updates_testing

[[root@localhost wilcal]# urpmi icecream
Package icecream-1.0.0-3.1.mga4.i586 is already installed
[root@localhost wilcal]# urpmi icecream-devel
Package icecream-devel-1.0.0-3.1.mga4.i586 is already installed
[root@localhost wilcal]# urpmi icecream-scheduler
Package icecream-scheduler-1.0.0-3.1.mga4.i586 is already installed

All packages update correctly and without error messages

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64

Comment 4 William Kenney 2014-08-24 19:19:02 CEST

In VirtualBox, M4, KDE, 64-bit

Package(s) under test:
icecream icecream-devel icecream-scheduler

default install of icecream icecream-devel icecream-scheduler

[root@localhost wilcal]# urpmi icecream
Package icecream-1.0.0-3.mga4.x86_64 is already installed
[root@localhost wilcal]# urpmi icecream-devel
Package icecream-devel-1.0.0-3.mga4.x86_64 is already installed
[root@localhost wilcal]# urpmi icecream-scheduler
Package icecream-scheduler-1.0.0-3.mga4.x86_64 is already installed

All packages installed correctly and without error messages

install icecream icecream-devel icecream-scheduler from updates_testing

[root@localhost wilcal]# urpmi icecream
Package icecream-1.0.0-3.1.mga4.x86_64 is already installed
[root@localhost wilcal]# urpmi icecream-devel
Package icecream-devel-1.0.0-3.1.mga4.x86_64 is already installed
[root@localhost wilcal]# urpmi icecream-scheduler
Package icecream-scheduler-1.0.0-3.1.mga4.x86_64 is already installed

All packages update correctly and without error messages

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.10-1.1.mga4.x86_64
virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64

Comment 5 William Kenney 2014-08-24 19:19:39 CEST

For me this update works fine.
Testing complete for mga3 32-bit & 64-bit
Testing complete for mga4 32-bit & 64-bit
Validating the update.
Could someone from the sysadmin team push this to updates.
Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO => MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK
CC: (none) => sysadmin-bugs

Comment 6 Dave Hodgins 2014-08-26 10:01:35 CEST

Advisory 13956.adv added to svn.

CC: (none) => davidwhodgins
Whiteboard: MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK => MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK advisory

Comment 7 Mageia Robot 2014-08-27 01:05:43 CEST

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0357.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED