PT-2014-8699 · Gnu+5 · Gnu Binutils+5

Published 2014-01-15 · Updated 2017-07-01 · CVE-2014-8737

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU binutils versions 2.24 and earlier

Description The issue allows local users to delete arbitrary files or create arbitrary files via directory traversal vulnerabilities in GNU binutils. This can be achieved by using a .. (dot dot) or full path name in an archive to various binutils commands.

Recommendations For GNU binutils versions 2.24 and earlier, consider restricting access to the archive functionality until a patch is available. As a temporary workaround, avoid using the .. (dot dot) or full path names in archives with commands such as strip, objcopy, or ar. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2014-1061

ALT-PU-2016-1015

CESA-2015_2079

CVE-2014-8737

DLA-184-1

DSA-3123-1

DSA-3123-2

ECHO-B44D-5EBA-01FD

MGASA-2015-0027

RHSA-2015:2079

RHSA-2015_2079

USN-2496-1

Affected Products

Alt Linux

Centos

Gnu Binutils

Red Hat

Suse

Ubuntu

References · 43

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=17552 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=17533 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-8737 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148438.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8504 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145256.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8501 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2496-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8503 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8738 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-8737 · Security Note
• https://debian.org/security/2015/dsa-3123 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147346.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-2079.html · Vendor Advisory