PCRE Regex Processing Bugs May Let Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1018895
|
|
SecurityTracker URL: http://securitytracker.com/id?1018895
|
|
CVE Reference: CVE-2007-1659
, CVE-2007-1660
(Links to External Site)
|
Date: Nov 6 2007
|
Impact: Execution of arbitrary code via local system, Execution of arbitrary code via network, User access via local system, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 7.0
|
Description: Two vulnerabilities were reported in PCRE. A local or remote user can execute arbitrary code on the target system.
A remote or local user may be able to supply a specially crafted regular expression to trigger a memory in PCRE.
The impact depends
on the application that uses the library. Applications that parse untrusted regular expressions may be vulnerable.
Unmatched
\Q\E sequences with orphan \E codes can cause code execution [CVE-2007-1659].
Certain character classes can trigger code execution
[CVE-2007-1660].
Tavis Ormandy reported these vulnerabilities.
|
Impact: A local or remote user can execute arbitrary code on the target system.
|
Solution: The vendor has issued a fixed version (7.3).
|
Vendor URL: www.pcre.org/ (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Mon, 5 Nov 2007 21:19:05 -0500
Subject: PCRE
|
CVE-2007-1659
unmatched \Q\E sequences with orphan \E codes can cause the compiled
regex to become desynchronized, resulting in corrupt bytecode that may
result in multiple exploitable conditions. This was inadvertently
fixed by the pcre maintainer in version 7.0, however another case of a
lone \E inside a character class remained, this has been fixed in 7.3
CVE-2007-1660
multiple forms of character class had their sizes miscalculated on
initial passes, resulting in too little memory being allocated, this
was also inadvertently fixed in version 7.0, where the compile phase
was entirely re-engineered (and much improved, from a security
standpoint).
|
|
