The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).

The remote host is affected by the vulnerability described in GLSA-201612-54 (Chicken: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chicken. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Apply patch to work around out of bounds bug: BZ 1231871.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

chicken developer Peter Bex reports :

Using gcc's Address Sanitizer, it was discovered that the string-translate* procedure from the data-structures unit can scan beyond the input string's length up to the length of the source strings in the map that's passed to string-translate*. This issue was fixed in master 8a46020, and it will make its way into CHICKEN 4.10.

This bug is present in all released versions of CHICKEN.

ID	Name	Product	Family	Severity
96229	GLSA-201612-54 : Chicken: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
84459	Fedora 22 : chicken-4.9.0.1-4.fc22 (2015-10333)	Nessus	Fedora Local Security Checks	high
84455	Fedora 21 : chicken-4.9.0.1-4.fc21 (2015-10165)	Nessus	Fedora Local Security Checks	high
84321	FreeBSD : chicken -- Potential buffer overrun in string-translate* (0da404ad-1891-11e5-a1cf-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-4556

high

Tenable Plugins

high

high

high

high