CVE-2012-6089: Buffer Overflow
First published: Thu Jan 03 2013(Updated: )
Changelog for pl-6.2.5 reads: * FIXED: Possible buffer overrun in patch canonisation code. Pushes pointers on an automatic array without checking for overflow. Can be used for DoS attacks. Will be extremely hard to make it execute arbitrary code. * SECURITY: Possible buffer overflows when expanding file-names with long paths. Affects expand_file_name/2. Can lead to crashes (DoS attacks) and possibly execution of arbitrary code if an attacker can control the names of the files searched for, e.g., if expand_file_name/2 is used in a directory to which an attacker can upload files for which he can control the name. These fixes are implemented by upstream commits: From a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c Mon Sep 17 00:00:00 2001 From: Jan Wielemaker <J.Wielemaker.nl> Date: Sun, 16 Dec 2012 18:13:17 +0100 Subject: [PATCH] FIXED: Possible buffer overrun in patch canonisation code. Pushes pointers on an automatic array without checking for overflow. Can be used for DoS attacks. Will be extremely hard to make it execute arbitrary code. From b2c88972e7515ada025e97e7d3ce3e34f81cf33e Mon Sep 17 00:00:00 2001 From: Jan Wielemaker <J.Wielemaker.nl> Date: Sun, 16 Dec 2012 17:29:37 +0100 Subject: [PATCH] SECURITY: Possible buffer overflows when expanding file-names with long paths. Affects expand_file_name/2. Can lead to crashes (DoS attacks) and possibly execution of arbitrary code if an attacker can control the names of the files searched for, e.g., if expand_file_name/2 is used in a directory to which an attacker can upload files for which he can control the name. I believe the vulnerabilities exist in older pl.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Swi-prolog Swi-prolog | <=6.2.4 | |
| Swi-prolog Swi-prolog | =5.6.50 | |
| Swi-prolog Swi-prolog | =5.6.51 | |
| Swi-prolog Swi-prolog | =5.6.52 | |
| Swi-prolog Swi-prolog | =5.6.53 | |
| Swi-prolog Swi-prolog | =5.6.54 | |
| Swi-prolog Swi-prolog | =5.6.55 | |
| Swi-prolog Swi-prolog | =5.6.56 | |
| Swi-prolog Swi-prolog | =5.6.57 | |
| Swi-prolog Swi-prolog | =5.6.58 | |
| Swi-prolog Swi-prolog | =5.6.59 | |
| Swi-prolog Swi-prolog | =5.6.61 | |
| Swi-prolog Swi-prolog | =5.6.62 | |
| Swi-prolog Swi-prolog | =5.6.63 | |
| Swi-prolog Swi-prolog | =5.6.64 | |
| Swi-prolog Swi-prolog | =5.8.0 | |
| Swi-prolog Swi-prolog | =5.8.1 | |
| Swi-prolog Swi-prolog | =5.8.2 | |
| Swi-prolog Swi-prolog | =5.8.3 | |
| Swi-prolog Swi-prolog | =5.10.0 | |
| Swi-prolog Swi-prolog | =5.10.1 | |
| Swi-prolog Swi-prolog | =5.10.2 | |
| Swi-prolog Swi-prolog | =5.10.3 | |
| Swi-prolog Swi-prolog | =5.10.4 | |
| Swi-prolog Swi-prolog | =5.10.5 | |
| Swi-prolog Swi-prolog | =6.0.0 | |
| Swi-prolog Swi-prolog | =6.0.1 | |
| Swi-prolog Swi-prolog | =6.0.2 | |
| Swi-prolog Swi-prolog | =6.2.0 | |
| Swi-prolog Swi-prolog | =6.2.1 | |
| Swi-prolog Swi-prolog | =6.2.2 | |
| Swi-prolog Swi-prolog | =6.2.3 | |
| Swi-prolog Swi-prolog | =6.3.0 | |
| Swi-prolog Swi-prolog | =6.3.1 | |
| Swi-prolog Swi-prolog | =6.3.2 | |
| Swi-prolog Swi-prolog | =6.3.3 | |
| Swi-prolog Swi-prolog | =6.3.4 | |
| Swi-prolog Swi-prolog | =6.3.5 | |
| Swi-prolog Swi-prolog | =6.3.6 | |
| redhat/SWI-Prolog | <6.3.7 | 6.3.7 |
| redhat/SWI-Prolog | <6.2.5 | 6.2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://openwall.com/lists/oss-security/2013/01/03/7
- http://www.swi-prolog.org/git/pl.git/commit/a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c
- https://bugzilla.redhat.com/show_bug.cgi?id=891577
- https://lists.iai.uni-bonn.de/pipermail/swi-prolog/2012/009428.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=891666
- http://www.openwall.com/lists/oss-security/2013/01/03/3
- http://www.openwall.com/lists/oss-security/2013/01/03/7
- https://access.redhat.com/security/cve/CVE-2012-6089
- https://access.redhat.com/security/cve/CVE-2012-6090
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=672370&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=672370&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=672371&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=672371&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=672401&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=672401&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=672402&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=672402&action=edit
- https://access.redhat.com/security/updates/classification/
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-6089
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/remedy
- agent/severity
- agent/weakness
- agent/tags
- agent/event
- agent/description
- vendor/swi-prolog
- canonical/swi-prolog swi-prolog
- version/swi-prolog swi-prolog/6.2.4
- version/swi-prolog swi-prolog/5.6.50
- version/swi-prolog swi-prolog/5.6.51
- version/swi-prolog swi-prolog/5.6.52
- version/swi-prolog swi-prolog/5.6.53
- version/swi-prolog swi-prolog/5.6.54
- version/swi-prolog swi-prolog/5.6.55
- version/swi-prolog swi-prolog/5.6.56
- version/swi-prolog swi-prolog/5.6.57
- version/swi-prolog swi-prolog/5.6.58
- version/swi-prolog swi-prolog/5.6.59
- version/swi-prolog swi-prolog/5.6.61
- version/swi-prolog swi-prolog/5.6.62
- version/swi-prolog swi-prolog/5.6.63
- version/swi-prolog swi-prolog/5.6.64
- version/swi-prolog swi-prolog/5.8.0
- version/swi-prolog swi-prolog/5.8.1
- version/swi-prolog swi-prolog/5.8.2
- version/swi-prolog swi-prolog/5.8.3
- version/swi-prolog swi-prolog/5.10.0
- version/swi-prolog swi-prolog/5.10.1
- version/swi-prolog swi-prolog/5.10.2
- version/swi-prolog swi-prolog/5.10.3
- version/swi-prolog swi-prolog/5.10.4
- version/swi-prolog swi-prolog/5.10.5
- version/swi-prolog swi-prolog/6.0.0
- version/swi-prolog swi-prolog/6.0.1
- version/swi-prolog swi-prolog/6.0.2
- version/swi-prolog swi-prolog/6.2.0
- version/swi-prolog swi-prolog/6.2.1
- version/swi-prolog swi-prolog/6.2.2
- version/swi-prolog swi-prolog/6.2.3
- version/swi-prolog swi-prolog/6.3.0
- version/swi-prolog swi-prolog/6.3.1
- version/swi-prolog swi-prolog/6.3.2
- version/swi-prolog swi-prolog/6.3.3
- version/swi-prolog swi-prolog/6.3.4
- version/swi-prolog swi-prolog/6.3.5
- version/swi-prolog swi-prolog/6.3.6
- package-manager/redhat