t1lib security flaw: CVE-2007-4033/#439927

1 msg	retspeon
1 msg	awames
1 msg	bainamnu
2 msg	Re: [SECURITY] [DSA 1378-1] New Linux 2.6.18 pa...
1 msg	eastland racial breakpoint ;
2 msg	RE: [SECURITY] [DSA 1364-2] New vim packages fi...
9 msg	Re: [SECURITY] [DSA 1378-1] New Linux 2.6.18 pa...
3 msg	[SECURITY] [DSA 1376-1]: missing dependencies r...
1 msg	cohort cohorts cohron
1 msg	Re: [SECURITY] [DSA 1377-1] New fetchmail packa...
12 msg	Re: [SECURITY] [DSA 1376-1] New kdebase package...
3 msg	Re: [SECURITY] [DSA 1375-1] New OpenOffice.org ...
1 msg	Earn $24 per daily to keep your pc online with ...
1 msg	Re: mpop: version 1.0.5-1etch1 uninstallable on...

t1lib security flaw: CVE-2007-4033/#439927
\ Artur R. Czechowski (16 Sep 2007)
. \ Torsten Werner (17 Sep 2007)
. . \ Torsten Werner (27 Sep 2007)
. . . \ Ionut Georgescu (28 Sep 2007)
. . . . \ Steffen Joeris (28 Sep 2007)

1 msg	Debian-Bounce-Test debian-security Sat, 15 Sep ...
1 msg	Inheritance fund
1 msg	UPDATED: Grand Opening of Republic Fridays &...
1 msg	Re: [SECURITY] [DSA 1374-1] New jffnms packages...
1 msg	Re: [SECURITY] [DSA 1371-1] New phpwiki package...

Subject:	t1lib security flaw: CVE-2007-4033/#439927
Group:	Debian-security
From:	Artur R. Czechowski
Date:	16 Sep 2007

forwarded 439927 rainer.menzner
tag 439927 patch confirmed upstream
severity 439927 serious
found 439927 5.1.0-2
thanks

Hi,
The t1lib 5.1.0 available in Debian (either etch as lenny and sid[1]) is
vulnerable to CVE-2007-4033 security flaw.
Upstream version 5.1.1 is vulnerable too. Upstream has been informed
about the issue.

I attached a patch solving the issue.

Best regards
Artur

[1] sarge probably too, I didn't check it.
--
Po co mamy ze sobą rozmawiać, skoro tak łatwo się komunikować?
/Jean Baudrillard/

--- t1env.c.orig 2007-09-16 19:56:38.319184208 +0200
+++ t1env.c 2007-09-16 20:05:02.057070439 +0200
@@ -611,6 +611,12 @@
#endif
strcat( pathbuf, DIRECTORY_SEP);
/* And finally the filename: */
+ /* If current pathbuf + StrippedName + 1 byte for NULL is bigger than pathbuf
+ let's try next pathbuf */
+ if( strlen(pathbuf) + strlen(StrippedName) + 1 > sizeof(pathbuf) ) {
+ i++;
+ continue;
+ }
strcat( pathbuf, StrippedName);

/* Check for existence of the path: */