PT-2019-6682 · Hardlink · Hardlink

Jan Lieskovsky · Publicado 2019-11-26 · Atualizado 2024-06-15 · CVE-2011-3630

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions hardlink versions prior to 0.1.2

Description The issue arises from the way hardlink processes directory trees with deeply nested directories, leading to multiple stack-based buffer overflow flaws. A remote attacker could provide a specially-crafted directory tree and trick the local user into consolidating it. This could result in the hardlink executable crashing or potentially executing arbitrary code with the privileges of the user running the hardlink executable.

Recommendations For versions prior to 0.1.2, update to version 0.1.2 or later to resolve the issue. As a temporary workaround, consider avoiding the consolidation of directory trees with deeply nested directories until a patch is applied.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2011-3630

OPENSUSE-SU-2024:10055-1

Produtos afetados

Hardlink

Referências · 11

• https://suse.com/security/cve/CVE-2011-3632 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10055-1 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2011-3630 · Nota
• https://t.me/cibsecurity/8319 · Publicação no Telegram
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516 · Nota
• https://suse.com/security/cve/CVE-2011-3631 · Nota
• https://suse.com/security/cve/CVE-2011-3630 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-3630 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3630 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2011-3630 · Nota de Segurança
• https://openwall.com/lists/oss-security/2011/10/20/6 · Nota