CVE-2006-7228: Buffer Overflow
CVE-2006-7224 initially described several integer overflows in pcre, all described here: http://scary.beasts.org/security/CESA-2007-006.html
This id should be used to describe issue #2 in that advisory:
3) More possible integer overflow trouble.
pcrecompile: --- if (min == 0) { length++; if (max > 0) length += (max - 1) (duplength + 3 + 2LINKSIZE); } ... else { length += (min - 1) duplength; if (max > min) / Need this test as max=-1 means no limit / length += (max - min) (duplength + 3 + 2LINKSIZE) - (2 + 2LINKSIZE); } ---
In both these cases, I see no reason why a malicious regexp pattern couldn't cause an integer overflow by using large min / max / duplength values. This will really mess up the critical "length" value.
Other sources
Integer overflow in Perl-Compatible Regular Expression (PCRE) library before 6.7 might allow context-dependent attackers to execute arbitrary code via a regular expression that involves large (1) min, (2) max, or (3) duplength values that cause an incorrect length calculation and trigger a buffer overflow, a different vulnerability than CVE-2006-7227. NOTE: this issue was originally subsumed by CVE-2006-7224, but that CVE has been REJECTED and split.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2006-7228?
CVE-2006-7228 is considered a critical vulnerability due to potential integer overflows in the PCRE implementation.
How do I fix CVE-2006-7228?
To fix CVE-2006-7228, update the PCRE package to version 0:4.5-4.el4_6.6 or later as specified in the applicable remediation.
Which software is affected by CVE-2006-7228?
CVE-2006-7228 affects specific versions of PCRE and Python packages on Red Hat-based systems.
What type of vulnerability is CVE-2006-7228?
CVE-2006-7228 is an integer overflow vulnerability which can lead to security flaws in applications using PCRE.
Is there a known exploit for CVE-2006-7228?
Yes, there have been reports of exploits leveraging the integer overflow vulnerabilities identified in CVE-2006-7228.