{"push_id":3154559872,"size":2,"distinct_size":2,"ref":"refs/heads/master","head":"b6895be1cb5b915254ee92c2150e309cd31ebff6","before":"c659b38346244fd8a2052e3c3ef0cbf30f7ac824","commits":[{"sha":"67256322aa5a1fff01de471d6787d1d862678746","author":{"name":"Ralph Boehme","email":"57e8a7776d6892a83f2a49678f8141f4fb883e62@samba.org"},"message":"CVE-2018-1160: libatalk/dsi: avoid double use of variable i\n\nSigned-off-by: Ralph Boehme <slow@samba.org>\nReviewed-by: HAT <hat@fa2.so-net.ne.jp>\nReviewed-by: Andrew Stormont <andyjstormont@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Netatalk/Netatalk/commits/67256322aa5a1fff01de471d6787d1d862678746"},{"sha":"b6895be1cb5b915254ee92c2150e309cd31ebff6","author":{"name":"Ralph Boehme","email":"57e8a7776d6892a83f2a49678f8141f4fb883e62@samba.org"},"message":"CVE-2018-1160: libatalk/dsi: add correct bound checking to dsi_opensession\n\nThe memcpy\n\n  memcpy(&dsi->attn_quantum, dsi->commands + i + 1, dsi->commands[i]);\n\ntrusted dsi->commands[i] to specify a size that fits into dsi->attn_quantum. The\nsizeof attn_quantum is four bytes. A malicious client can send a dsi->command[i]\nlarger than 4 bytes to begin overwriting variables in the DSI struct.\n\ndsi->command[i] is a single char in a char array which limits the amount of data\nthe attacker can overwrite in the DSI struct to 0xff. So for this to be useful\nin an attack there needs to be something within the 0xff bytes that follow\nattn_quantum. From dsi.h:\n\n    uint32_t attn_quantum, datasize, server_quantum;\n    uint16_t serverID, clientID;\n    uint8_t  *commands; /* DSI recieve buffer */\n    uint8_t  data[DSI_DATASIZ];    /* DSI reply buffer */\n\nThe commands pointer is a heap allocated pointer that is reused for every packet\nreceived and sent. Using the memcpy, an attacker can overwrite this to point to\nan address of their choice and then all subsequent AFP packets will be written\nto that location.\n\nIf the attacker chose the preauth_switch buffer, overwriting the function\npointer there with functions pointers of his choice, he can invoke this\nfunctions over the network,\n\nSigned-off-by: Ralph Boehme <slow@samba.org>\nReviewed-by: HAT <hat@fa2.so-net.ne.jp>\nReviewed-by: Andrew Stormont <andyjstormont@gmail.com>","distinct":true,"url":"https://api.github.com/repos/Netatalk/Netatalk/commits/b6895be1cb5b915254ee92c2150e309cd31ebff6"}]}
{"actor":{"display_login":"slowfranklin"}}