From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason at zx2c4.com (Jason A. Donenfeld) Date: Sun, 30 Sep 2012 21:21:02 +0200 Subject: cgit: heap buffer overflow Message-ID: Hey oss-sec, The original author and maintainer of cgit, Lars Hjemli, has been MIA for the last several months, and nobody I've talked to seems to know what's happened. Because I've previously been involved with some cgit things, I'm maintaining a tree of my own to which folks on the cgit mailing list are now sending patches. It'd be a bit presumptuous to call myself the new maintainer, but I am trying to keep the project alive and healthy until Lars returns from wherever he is. Jim Meyering from Redhat has written to the cgit mailing list with a detailed analysis and a two line commit fixing a heap buffer overflow. At the minimum, it's a denial of service, and in the worst case, it might lead to to a remote shell. If anyone has any tricks on how to exploit it successfully, I'd be interested to hear them. You can read his analysis and look at the commit here [1] and a Redhat bug report here [2]. If this oss-sec finds it concerning enough, I can tag a non-Lars-approved release and post links to new tarballs for folks. But there's a chance that exploitation isn't feasible, as Jim has written in his report, in which case I'd like to hold off on making any non-Lars-approved releases for a bit. Thanks, Jason [1] http://git.zx2c4.com/cgit/commit/?id=7757d1b046ecb67b830151d20715c658867df1ec [2] https://bugzilla.redhat.com/show_bug.cgi?id=820733