PT-2019-6682 · Hardlink · Hardlink

Jan Lieskovsky · Published 2019-11-26 · Updated 2024-06-15 · CVE-2011-3630

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions hardlink versions prior to 0.1.2

Description The issue arises from the way hardlink processes directory trees with deeply nested directories, leading to multiple stack-based buffer overflow flaws. A remote attacker could provide a specially-crafted directory tree and trick the local user into consolidating it. This could result in the hardlink executable crashing or potentially executing arbitrary code with the privileges of the user running the hardlink executable.

Recommendations For versions prior to 0.1.2, update to version 0.1.2 or later to resolve the issue. As a temporary workaround, consider avoiding the consolidation of directory trees with deeply nested directories until a patch is applied.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2011-3630

OPENSUSE-SU-2024:10055-1

Affected Products

Hardlink

References · 11

• https://osv.dev/vulnerability/openSUSE-SU-2024:10055-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3630 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3630 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-3630 · Security Note
• https://suse.com/security/cve/CVE-2011-3632 · Note
• https://access.redhat.com/security/cve/cve-2011-3630 · Note
• https://t.me/cibsecurity/8319 · Telegram Post
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516 · Note
• https://suse.com/security/cve/CVE-2011-3631 · Note
• https://suse.com/security/cve/CVE-2011-3630 · Note
• https://openwall.com/lists/oss-security/2011/10/20/6 · Note