Stay Secure with the Latest Linux Advisories

security advisorycriticaldirectory traversal

Ubuntu 14.10 USN-2482-1: Critical Elfutils Directory Traversal

elfutils could be made to overwrite files in the root directory if it receiveda specially crafted file.. =========================================================================Ubuntu Security Notice USN-2482-1 January 23, 2015 elfutils vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: elfutils could be made to overwrite files in the root directory if it received a specially crafted file. Software Description: - elfutils: collection of utilities to handle ELF objects Details: Alexander Cherepanov discovered that libelf1 incorrectly handled certain filesystem paths while extracting ar archives. An attacker could use this flaw to perform a directory traversal attack on the root directory if the process extracting the ar archive has write access to the root directory. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.10: libelf1 0.160-0ubuntu2.1 Ubuntu 14.04 LTS: libelf1 0.158-0ubuntu5.2 Ubuntu 12.04 LTS: libelf1 0.152-1ubuntu3.1 Ubuntu 10.04 LTS: libelf1 0.143-1ubuntu0.1 After a standard system update you need to restart applications using libelf1 to make all the necessary changes. References: CVE-2014-9447 Package Information: https://launchpad.net/ubuntu/+source/elfutils/0.160-0ubuntu2.1 https://launchpad.net/ubuntu/+source/elfutils/0.158-0ubuntu5.2 https://launchpad.net/ubuntu/+source/elfutils/0.152-1ubuntu3.1 https://launchpad.net/ubuntu/+source/elfutils/0.143-1ubuntu0.1 . A significant flaw in elfutils on Ubuntu enables file corruption at root level when specific malicious files are utilized.. Elfutils Vulnerability, Ubuntu Security Advisory, Directory Traversal Risk. . Severity: Critical. LinuxSecurity.com Team

Jan 23, 2015 •Critical Ubuntu