Roundup: [oss-security] One byte stack buffer overflow in keepassxc / zxcvbn-c

[grahamc]

Here is a report from the oss-security mailing list for Vulnerability Roundup 27.

Skip to First Email

Instructions:

Identification

Identify if we have the software, in 16.09, 17.03, and unstable. Then determine if we are vulnerable, and make a comment with your findings. It can also be helpful to specify if you think there is a patch, or if it can be fixed via a general update.

Example:

unstable: we are not vulnerable (link to the package)
17.03: we are vulnerable (link to the package)
16.09: we don't have it packaged

IMPORTANT: If you believe there are possibly related issues, bring them up on the parent issue!

Patching

Start by commenting on this issue saying you're working on a patch. This way, we don't duplicate work.

If you open a pull request, tag this issue and the master issue for the roundup.

If you commit the patch directly to a branch, please leave a comment on this issue with the branch and the commit hash, example:

fixed:

release-16.09: abc123

Skip to First Email

Upon Completion ...

• Update Graham's database

Info

Triage Indicator:

-needs-triage +roundup27 thread:0000000000003fa8

• File Search: https://search.nix.gsc.io/?q=keepassxc&i=fosho&repos=nixos-nixpkgs
• GitHub Search: https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q=keepassxc+in%3Apath&type=Code

Should the search term be changed from keepassxc? Suggest a new package search by commenting:

-suggested:keepassxc +suggested:correctPackageName thread:0000000000003fa8

Known CVEs:

---

Skip to End

Sat, 4 Mar 2017 16:48:23 +0100 Hanno Böck <hanno-at-hboeck.de>, 20170304164823.3fb862c4@pc1

Hi,

I recently reported a one byte buffer overflow in keepassxc [1] [2].
It's a pretty typical C bug: An array supposed to hold a string of a
certain size plus a trailing zero byte is one byte too small (i.e. the
size doesn't consider the trailing zero).
Given that the overflow happens right at the application's startup I
doubt it's exploitable in a meaningful way.
The bug was discovered simply by compiling with asan and running
keepassxc.

The code comes from zxcvbn-c (a checker for password quality), where
I've also reported it [3] (together with another minor bug regarding a
misuse of new [] / delete).

keepassxc is a fork of keepassx. However keepassx is not affected, as
it doesn't contain the zxcvbn password quality checking code.

One takeaway of this is that even amongst developers of security tools
the use of address sanitizer is still not a standard practice
everyone's using to test their C code.


[1] https://github.com/keepassxreboot/keepassxc/pull/363
[2] https://github.com/keepassxreboot/keepassxc/pull/365
[3] https://github.com/tsyrogit/zxcvbn-c/pull/11

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno@hboeck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Skip to End

---

[Mic92]

release-16.09: we don't have it packaged
fixed:
unstable: 5e0cbbbdb6600335dde8c25b25c62a329b02c284
release-17.03: 8ce595fcd1898c586a8b8c8110647bc7a21aec2b

[grahamc]

Thank you!