Bug 12691 - cxxtools new security issue CVE-2013-7298
Summary: cxxtools new security issue CVE-2013-7298
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/583136/
Whiteboard: has_procedure MGA4-64-OK MGA4-32-OK a...
Keywords: Security, validated_update
Depends on:
Blocks:
 
Reported: 2014-02-09 19:56 CET by Anssi Hannula
Modified: 2014-02-18 17:45 CET (History)
3 users (show)

See Also:
Source RPM: cxxtools
CVE: CVE-2013-7298
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Anssi Hannula 2014-02-09 19:56:43 CET 
Advisory:
============
A flaw in cxxtools version 2.2 allows remote attackers to cause a denial of service (infinite recursion and crash) via an HTTP query that contains %% (double percent) characters (CVE-2013-7298).

This update fixes the vulnerability.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7298
============

Updated packages in mga4 core/updates_testing. mga3 is not affected.

Source packages:
cxxtools-2.2-2.1.mga4

Binary packages:
lib64cxxtools9-2.2-2.1.mga4
lib64cxxtools-devel-2.2-2.1.mga4
Comment 1 David Walser 2014-02-09 21:33:21 CET 
Will you fix this for Mageia 3 as well?
David Walser 2014-02-09 21:35:01 CET

Whiteboard: (none) => feedback

Comment 2 Anssi Hannula 2014-02-09 21:40:28 CET 
From description: "mga3 is not affected."

Whiteboard: feedback => (none)

Comment 3 David Walser 2014-02-09 21:50:48 CET 
Oh sorry, I missed that.  All of the outside references I looked at said versions before 2.2.1 were affected.  Where did you determine that?

Summary: cxxtools CVE-2013-7298 (mga4) => cxxtools new security issue CVE-2013-7298

Comment 4 Anssi Hannula 2014-02-09 21:53:20 CET 
The code was very different pre-2.2, and Debian handler wasn't able to reproduce: http://comments.gmane.org/gmane.linux.debian.devel.secure-testing.cvs/26659
David Walser 2014-02-10 02:41:24 CET

Severity: normal => major

Comment 5 claire robinson 2014-02-12 18:18:50 CET 
libcxxtools is used by tntnet (bug 12616) so both can be tested together
claire robinson 2014-02-12 18:19:07 CET

Whiteboard: (none) => has_procedure

Manuel Hiebel 2014-02-13 23:21:02 CET

Whiteboard: has_procedure => has_procedure MGA4-64-OK

Comment 6 Carolyn Rowse 2014-02-15 20:29:08 CET 
Tested Mga4 32-bit with tntnet, nothing unexpected encountered.

Update validated.

See Description for advisory.

SRPM: cxxtools-2.2-2.1.mga4.src.rpm

Could sysadmin please push from core/updates_testing to core/updates.

Thank you.

Keywords: (none) => validated_update
CC: (none) => isolde, sysadmin-bugs
Whiteboard: has_procedure MGA4-64-OK => has_procedure MGA4-64-OK MGA4-32-OK

Comment 7 Thomas Backlund 2014-02-16 14:46:38 CET 
Update pushed:
http://advisories.mageia.org/MGASA-2014-0073.html

Status: ASSIGNED => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED
Whiteboard: has_procedure MGA4-64-OK MGA4-32-OK => has_procedure MGA4-64-OK MGA4-32-OK advisory

David Walser 2014-02-18 17:45:20 CET

URL: (none) => http://lwn.net/Vulnerabilities/583136/
Note You need to log in before you can comment on or make changes to this bug.