Security_Advisory-Ref_oCERT-2008-014-WordNet_stack_overflows.txt

oCERT-2008-014 WordNet stack and heap overflows

Description:

The WordNet 3.0 Unix library and command-line interface suffer from a number of
stack overflows due to their handling of command line arguments, environment
variables and data read from user supplied dictionaries.

The oCERT team was contacted by Moritz Muehlenhoff from the Debian project
requesting an audit of the WordNet code base. These vulnerabilities were the
findings of the requested audit.

Stack overflows fed via the command line, environment variables or WordNet
library calls can result in arbitrary code execution.

Stack and heap overflows via modified WordNet dictionaries may allow arbitrary
code execution.

It should be noted that despite the ease with which arbitrary code can be
executed via these WordNet flaws, unless WordNet is being used by a daemon or
web service running as a user other than that of the attacker, this is unlikely
to result in privilege escalation or the ability to take any action not already
possible as the attacking user.

The following patch fixes the issues:
  http://ocert.org/analysis/2008-014/wordnet.patch.2

Affected version:

WordNet = 3.0

Fixed version:

Princeton unfortunately lack the resources to produce a new release of
this code and will therefore not be releasing a new version as a result of
this audit.

Credit: Rob Holland, oCERT Team | Inverse Path Ltd

CVE: CVE-2008-3908

Timeline:

2008-06-02: audit requested
2008-06-25: first phase audit completed
2008-07-15: second phase audit completed
2008-07-19: report and patch sent upstream and to audit requester
2008-08-12: report and patch resent upstream due to lack of response
2008-08-13: upstream acknowledge issues
2008-09-01: advisory release
2008-09-04: assigned CVE
2008-09-06: patch updated due to bug, not security sensitive

References:

oCERT vulnerability analysis report
  http://ocert.org/analysis/2008-014/analysis.txt