CVE-2012-4527: Buffer Overflow
Created attachment 629285 [details] patch to fix the buffer overflow
Description of problem: A buffer overflow in mcrypt version 2.6.8 and earlier due to long filenames. If a user were tricked into attempting to encrypt/decrypt specially crafted long filename(s), this flaw would cause a stack-based buffer overflow that could potentially lead to arbitrary code execution.
Note that this is caught by FORTIFYSOURCE, which renders this to being a crash-only bug on Fedora.
There are currently no upstream patches for this flaw.
Version-Release number of selected component (if applicable): mcrypt-2.6.8-9.el6 (possibly others too).
How reproducible: Run mcrypt with ~128 byte long file names.
Other sources
Stack-based buffer overflow in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file name. NOTE: it is not clear whether this is a vulnerability.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4527?
CVE-2012-4527 is categorized as a high severity vulnerability due to the potential for buffer overflow exploits.
How do I fix CVE-2012-4527?
To fix CVE-2012-4527, update Mcrypt to a version higher than 2.6.8 or apply the relevant patches provided.
What software is affected by CVE-2012-4527?
CVE-2012-4527 affects versions of Mcrypt up to and including 2.6.8, as well as specific versions 2.6.4, 2.6.5, 2.6.6, and 2.6.7.
Can CVE-2012-4527 lead to data breaches?
Yes, if exploited, CVE-2012-4527 can potentially lead to data breaches through unauthorized access or data manipulation.
Is CVE-2012-4527 a widely known vulnerability?
Yes, CVE-2012-4527 is a known vulnerability within the Mcrypt library and has been discussed in various security advisories.