Ubuntu 14.10 USN-2482-1: Critical Elfutils Directory Traversal

ubuntu

January 23, 2015

elfutils could be made to overwrite files in the root directory if it receiveda specially crafted file.

Summary

elfutils could be made to overwrite files in the root directory if it received

a specially crafted file.

Software Description:

- elfutils: collection of utilities to handle ELF objects

Details:

Alexander Cherepanov discovered that libelf1 incorrectly handled certain

filesystem paths while extracting ar archives. An attacker could use this flaw

to perform a directory traversal attack on the root directory if the process

extracting the ar archive has write access to the root directory.

Topics Covered

security advisory critical directory traversal Ubuntu elfutils overwrite libelf1

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libelf1                         0.160-0ubuntu2.1

Ubuntu 14.04 LTS:
  libelf1                         0.158-0ubuntu5.2

Ubuntu 12.04 LTS:
  libelf1                         0.152-1ubuntu3.1

Ubuntu 10.04 LTS:
  libelf1                         0.143-1ubuntu0.1

After a standard system update you need to restart applications using libelf1
to make all the necessary changes.