PT-2014-8699 · Gnu+5 · Gnu Binutils+5

Publicado 2014-01-15 · Atualizado 2017-07-01 · CVE-2014-8737

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU binutils versions 2.24 and earlier

Description The issue allows local users to delete arbitrary files or create arbitrary files via directory traversal vulnerabilities in GNU binutils. This can be achieved by using a .. (dot dot) or full path name in an archive to various binutils commands.

Recommendations For GNU binutils versions 2.24 and earlier, consider restricting access to the archive functionality until a patch is available. As a temporary workaround, avoid using the .. (dot dot) or full path names in archives with commands such as strip, objcopy, or ar. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

ALT-PU-2014-1061

ALT-PU-2016-1015

CESA-2015_2079

CVE-2014-8737

DLA-184-1

DSA-3123-1

DSA-3123-2

ECHO-B44D-5EBA-01FD

MGASA-2015-0027

RHSA-2015:2079

RHSA-2015_2079

USN-2496-1

Produtos afetados

Alt Linux

Centos

Gnu Binutils

Red Hat

Suse

Ubuntu

Referências · 43

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=17552 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=17533 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-8737 · Aviso do Fabricante
• http://securityfocus.com/bid/70908 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148438.html · Aviso do Fabricante
• http://secunia.com/advisories/62746 · Nota
• https://ubuntu.com/security/CVE-2014-8504 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145256.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-8501 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-2496-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-8503 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-8738 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-8737 · Nota de Segurança
• https://debian.org/security/2015/dsa-3123 · Aviso do Fabricante