Path traversal in Sourceware elfutils

1) Path traversal

EUVDB-ID: #VU40974

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-9447

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

elfutils: 0.152 - 0.161

CPE2.3

• cpe:2.3:a:sourceware:elfutils:0.152:*:*:*:*:*:*:*
• cpe:2.3:a:sourceware:elfutils:0.161:*:*:*:*:*:*:*

External links

https://advisories.mageia.org/MGASA-2015-0033.html
https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148321.html
https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148326.html
https://secunia.com/advisories/61934
https://secunia.com/advisories/62560
https://secunia.com/advisories/62661
https://www.mandriva.com/security/advisories?name=MDVSA-2015:047
https://www.openwall.com/lists/oss-security/2014/12/29/2
https://www.securityfocus.com/bid/71804
https://git.fedorahosted.org/cgit/elfutils.git/commit/?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e
https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-December/004499.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.