PT-2003-1051 · Gnu · File

David Endler

·

Publicado

2003-03-05

·

Atualizado

2018-05-03

·

CVE-2003-0102

CVSS v2.0

4.6

Média

VetorAV:L/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions file versions 3.39
Description The issue is related to a buffer overflow in the tryelf() function in readelf.c of the file command, which allows attackers to execute arbitrary code as the user running file. This can be achieved possibly via a large entity size value in an ELF header (elfhdr.e shentsize). The exploitation of this issue can lead to a violation of confidentiality, integrity, and availability of protected information and can be performed locally.
Recommendations For file version 3.39, consider restricting access to the tryelf() function in readelf.c until a patch is available. As a temporary workaround, avoid using large entity size values in ELF headers to minimize the risk of exploitation.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

BDU:2015-07796
CVE-2003-0102
DSA-260

Produtos afetados

File