REDHAT-BUG-383341: Buffer Overflow

Published Nov 14, 2007

Updated

CVE-2006-7224 initially described several integer overflows in pcre, all described here: http://scary.beasts.org/security/CESA-2007-006.html

This id should be used to describe issue #1 in that advisory:

1) Integer overflow leading to buffer overflow.

pcrecompile: --- / Compute the size of data block needed and get it, either from malloc or externally provided function. /

size = length + sizeof(realpcre) + namecount (maxnamesize + 3); re = (realpcre )(pcremalloc)(size); ---

Unfortunately, a malicious regex can easily cause large "namecount" and "maxnamesize" such that this calculation overflows. Demo:

(?P)(?P<0>)(?P<1>)...fill in this sequence...(?P<4293>)

Affected Software

1 affected component

PCRE PCRE

Nov 14, 2007

Data Sourced

via Red Hat·08:49 PM

DescriptionSeverityAffected Software

The severity of REDHAT-BUG-383341 is classified as critical due to the potential for integer overflow vulnerabilities in PCRE.

To fix REDHAT-BUG-383341, upgrade to the latest version of PCRE that contains the necessary security patches.

REDHAT-BUG-383341 affects systems running vulnerable versions of the PCRE library.

REDHAT-BUG-383341 is an integer overflow vulnerability that may lead to system instability or arbitrary code execution.

REDHAT-BUG-383341 was disclosed in 2007, related to the CVE-2006-7224 vulnerabilities.