Onderwerp: [ GLSA 200503-12 ] Hashcash: Format string vulnerability

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig30753D8C94C3133A36D2217F
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200503-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Hashcash: Format string vulnerability
Date: March 06, 2005
Bugs: #83541
ID: 200503-12

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A format string vulnerability in the Hashcash utility could allow an
attacker to execute arbitrary code.

Background
==========

Hashcash is a utility for generating Hashcash tokens, a proof-of-work
system to reduce the impact of spam.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/hashcash < 1.16-r1 >= 1.16-r1

Description
===========

Tavis Ormandy of the Gentoo Linux Security Audit Team identified a flaw
in the Hashcash utility that an attacker could expose by specifying a
malformed reply address.

Impact
======

Successful exploitation would permit an attacker to disrupt Hashcash
users, and potentially execute arbitrary code.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Hashcash users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/hashcash-1.16-r1"

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200503-12.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0


--------------enig30753D8C94C3133A36D2217F
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCKwKIvcL1obalX08RAklhAJ44Y2Aa2rtxOFta0bmVLx Re+P3gegCeLv/x
TuSkOdMR2IgffA4FRNot8Bc=
=5frN
-----END PGP SIGNATURE-----

--------------enig30753D8C94C3133A36D2217F--

--=-=-=
Content-Transfer-Encoding: quoted-printable

>>>>> "Thierry" =3D=3D Thierry Carrez <koon@gentoo.org> writes:

[...]

Thierry> Affected packages
Thierry> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D

Thierry> --------------------------------------------------------------=
-----
Thierry> Package / Vulnerable / Unaffe=
cted
Thierry> --------------------------------------------------------------=
-----
Thierry> 1 net-misc/hashcash < 1.16-r1 >=3D 1=
..16-r1

Just to note, version 1.13 of hashcash (incidentally, the version that's
in Debian testing) doesn't seem to be vulnerable, as it doesn't contain
the buggy line that Travis found. I'm not sure exactly when the bug was
introduced.

=2D-=20
Hubert Chan <hubert@uhoreg.ca> - http://www.uhoreg.ca/
PGP/GnuPG key: 1024D/124B61FA
Fingerprint: 96C5 012F 5F74 A5F7 1FF7 5291 AF29 C719 124B 61FA
Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.

--=-=-=
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQBCLLPMrynHGRJLYfoRA3whAKCA+tLVd1GE0VUwIz6S5F ZRo4qBEQCfSifW
o2/t/re3vsvdu/LFlQmTpXo=
=4VcR
-----END PGP SIGNATURE-----
--=-=-=--

In-Reply-To: <87r7irrzne.fsf@evinrude.uhoreg.ca>

Hi

Two notes:

- the format string security bug is now fixed in hashcash-1.17

- Hubert is correct that the bug was not in hashcash-1.13, it was introduced in hashcash 1.14

Cheers

Adam

>Just to note, version 1.13 of hashcash (incidentally, the version that's
>in Debian testing) doesn't seem to be vulnerable, as it doesn't contain
>the buggy line that Travis found. I'm not sure exactly when the bug was
>introduced.