PT-2017-10942 · File+1 · File+1

Thomas Jarosch · Publicado 2017-09-05 · Atualizado 2024-06-15 · CVE-2017-1000249

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions file versions prior to the version containing commit 35c94dc6acc418f1ad7f6241a6680e5327495793

Description The issue allows an attacker to overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This can be exploited by leveraging a specially crafted ELF binary.

Recommendations For versions prior to the version containing commit 35c94dc6acc418f1ad7f6241a6680e5327495793, update to a version that includes the fix from commit 35c94dc6acc418f1ad7f6241a6680e5327495793 to resolve the issue. As a temporary workaround, consider restricting the use of the file() function with untrusted ELF binaries until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-1000249

DSA-3965-1

OPENSUSE-SU-2024:10755-1

Produtos afetados

Ubuntu

File

Referências · 22

• https://github.com/file/file/commit/9611f31313a93aa036389c5f3b15eea53510d4d · Correção
• https://github.com/file/file/commit/35c94dc6acc418f1ad7f6241a6680e5327495793 · Correção
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000249 · Nota de Segurança
• https://security-tracker.debian.org/tracker/source-package/file · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10755-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3965-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-1000249 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2007-1536 · Nota
• https://packages.debian.org/src:file · Nota
• https://security-tracker.debian.org/tracker/DSA-3965-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000249 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-3412-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-8904 · Nota
• https://suse.com/security/cve/CVE-2019-18218 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000249 · Aviso do Fabricante