PT-2015-4210 · Red Hat+3 · Elfutils+3

Published 2015-01-02 · Updated 2024-06-15 · CVE-2014-9447

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions elfutils versions 0.152 through 0.161

Description The issue allows remote attackers to write to arbitrary files in the root directory via a crafted archive. This is achieved by exploiting a directory traversal vulnerability in the read long names function. The vulnerability can be demonstrated using the ar program.

Recommendations For elfutils versions 0.152 through 0.161, consider restricting access to the read long names function in libelf/elf begin.c until a patch is available. As a temporary workaround, avoid using the ar program with untrusted archives.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2015-2001

CVE-2014-9447

MGASA-2015-0033

OPENSUSE-SU-2024:10570-1

SUSE-SU-2015:0292-1

SUSE-SU-2015:0434-1

SUSE-SU-2015_0292-1

SUSE-SU-2015_0434-1

USN-2482-1

Affected Products

Alt Linux

Suse

Ubuntu

Elfutils

References · 38

• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148321.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9447 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:0292-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9447 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9447 · Security Note
• https://ubuntu.com/security/CVE-2014-9447 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0033 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148326.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2482-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-9447 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9447 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:047 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-9447 · Security Note
• https://git.fedorahosted.org/cgit/elfutils.git/commit/?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0033.html · Security Note