| |||||||||||||||||||
Mageia alert MGASA-2012-0221 (hardlink)
MGASA-2012-0221 Date: August 18th, 2012 Affected releases: 1 Description: Updated hardlink package fixes security vulnerabilities: Multiple stack-based buffer overflow flaws were found in the way hardlink, the tool for consolidation of duplicate files via hardlinks, processed directory trees with deeply nested directories. A remote attacker could provide a specially-crafted directory tree, and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable. Because of the compiler options used to build this in Mageia, exploiting this would only cause a crash (CVE-2011-3630). Multiple integer overflows, leading to heap-based buffer overflows were found in the way hardlink, the tool for consolidation of duplicate files via hardlinks performed string lengths concatenation in the calculation of the required memory space to be used. A remote attacker could provide a specially-crafted directory tree (with long directory and / or file names), and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable (CVE-2011-3631). It was reported, that hardlink, the tool for consolidation of duplicate files via hardlinks operated on full file system objects path names. A local attacker could use this flaw to conduct symlink attacks (cause the hardlink executable to operate on directories / files outside of the intended directory tree) (CVE-2011-3632). Updated Packages: hardlink-1.0-11.1.mga1 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3630 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3631 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3632 http://lists.fedoraproject.org/pipermail/package-announce... https://bugs.mageia.org/show_bug.cgi?id=7005 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-... (Log in to post comments)
|
|||||||||||||||||||