PT-2015-4210 · Red Hat+3 · Elfutils+3

Publicado 2015-01-02 · Atualizado 2024-06-15 · CVE-2014-9447

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions elfutils versions 0.152 through 0.161

Description The issue allows remote attackers to write to arbitrary files in the root directory via a crafted archive. This is achieved by exploiting a directory traversal vulnerability in the read long names function. The vulnerability can be demonstrated using the ar program.

Recommendations For elfutils versions 0.152 through 0.161, consider restricting access to the read long names function in libelf/elf begin.c until a patch is available. As a temporary workaround, avoid using the ar program with untrusted archives.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

ALT-PU-2015-2001

CVE-2014-9447

MGASA-2015-0033

OPENSUSE-SU-2024:10570-1

SUSE-SU-2015:0292-1

SUSE-SU-2015:0434-1

SUSE-SU-2015_0292-1

SUSE-SU-2015_0434-1

USN-2482-1

Produtos afetados

Alt Linux

Suse

Ubuntu

Elfutils

Referências · 38

• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148321.html · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9447 · Aviso do Fabricante
• https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-December/004499.html · Nota
• https://osv.dev/vulnerability/SUSE-SU-2015:0292-1 · Aviso do Fabricante
• https://lists.suse.com/pipermail/sle-security-updates/2015-February/001227.html · Nota
• https://bugs.mageia.org/show_bug.cgi?id=15085 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9447 · Nota de Segurança
• http://secunia.com/advisories/62560 · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9447 · Nota de Segurança
• https://lists.suse.com/pipermail/sle-security-updates/2015-March/001269.html · Nota
• https://ubuntu.com/security/CVE-2014-9447 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-9447 · Nota
• https://osv.dev/vulnerability/MGASA-2015-0033 · Aviso do Fabricante
• http://secunia.com/advisories/61934 · Nota