Bug 72521 - sys-apps/file-4.12 heads up
|
Bug#:
72521
|
Product: Gentoo Security
|
Version: unspecified
|
Platform: All
|
|
OS/Version: All
|
Status: RESOLVED
|
Severity: major
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: jaervosz@gentoo.org
|
|
Component: Vulnerabilities
|
|
|
URL:
|
|
Summary: sys-apps/file-4.12 heads up
|
|
Keywords:
|
|
Status Whiteboard: A2 [glsa] jaervosz
|
|
Opened: 2004-11-25 20:31 0000
|
Stack smashing bug in file/src/readelf.c:donote() mentioned in file's
changelog does not look so harmless.
--- file-4.10/ChangeLog
I've already put a new one of these in the tree as ~arch-all
Waiting for a public disclosure date.
looks public
http://securitytracker.com/alerts/2004/Dec/1012433.html
'File' Stack Overflow in Processing ELF Headers May Permit Arbitrary Code Execution
SecurityTracker Alert ID: 1012433
SecurityTracker URL: http://securitytracker.com/id?1012433
CVE Reference: GENERIC-MAP-NOMATCH (Links to External Site)
Date: Dec 6 2004
Impact: Execution of arbitrary code via local system, Execution of arbitrary code via network
Version(s): prior to 4.12
Description: A vulnerability was reported in 'file'. A user may be able to execute arbitrary code on the target system.
Trustix reported a vulnerability in the ELF header parsing code in 'file'. A user may be able to create a specially crafted ELF file that, when processed using 'file', may be able to modify the stack and potentially execute arbitrary code.
Impact: A user may be able to execute arbitrary code on the target system.
Solution: No solution was available at the time of this entry.
Cause: Not specified
Underlying OS: Linux (Any), UNIX (Any)
Arches please mark 4.12 stable.
Target KEYWORDS="alpha amd64 arm hppa ia64 mips ppc ppc64 s390 sh sparc x86"
Note to sh: no arch alias exists so someone (vapier?) please mark it sh.
mips can't stable this revision unless we can get the
file-4.xx-mips-gentoo.diff patch to apply, otherwise, file gives bad output on
mips systems that mess up configure scripts.
The interesting thing is, the patch applies fine outside of portage, but
applying within the ebuild, the dry-run sweep creates .orig files that cause
epatch to fail on the second pass. We got a workaround for this?
Okay, disregard Comment #9; seems the patch we use it responsible for the .orig
file breaking things. Will fix && stabilize in the morning.
ppc64 please mark stable so that the GLSA can go out.
stable for everyone else now too
GLSA 200412-07
thanks everyone
lta Magdir/xenix Magdir/xo65 Magdir/xwindows Magdir/zilog Magdir/zyxel; do \
if test -f ./$frag; then \
f=./$frag; \
else \
f=$frag; \
fi; \
cat $f; \
done >> magic
/usr/bin/file -C -m magic
WARNING: type lestring16 >0 Description: %15.15s invalid
file: could not find any magic files!
make[2]: *** [magic.mgc] Error 255
make[2]: Leaving directory `/usr/tmp/portage/file-4.12/work/file-4.12/magic'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/usr/tmp/portage/file-4.12/work/file-4.12'
make: *** [all] Error 2
!!! ERROR: sys-apps/file-4.12 failed.
!!! Function src_compile, Line 51, Exitcode 2
!!! emake failed
!!! If you need support, post the topmost build error, NOT this status message.
Portage 2.0.51-r3 (hardened/x86, gcc-3.3.2, glibc-2.3.2-r12, 2.4.27-grsec-2.0.1 i686)
=================================================================
System uname: 2.4.27-grsec-2.0.1 i686 Pentium III (Coppermine)
Gentoo Base System version 1.4.3.13
Autoconf: sys-devel/autoconf-2.59-r4
Automake: sys-devel/automake-1.8.3
Binutils: sys-devel/binutils-2.14.90.0.8-r1
Headers: sys-kernel/linux-headers-2.4.19-r1,sys-kernel/linux-headers-2.4.21-r1
Libtools: sys-devel/libtool-1.5.2-r7
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CFLAGS="-march=pentium3 -mcpu=pentium3 -O2 -pipe"
CHOST="i686-pc-linux-gnu"
COMPILER=""
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/ /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-march=pentium3 -mcpu=pentium3 -O2 -pipe"
DISTDIR="/usr/local/download/portage/distfiles"
FEATURES="autoaddcvs ccache distlocks sandbox strict userpriv usersandbox"
GENTOO_MIRRORS="http://gentoo.osuosl.org http://distro.ibiblio.org/pub/Linux/distributions/gentoo"
MAKEOPTS="-j2"
PKGDIR="/usr/portage//packages/x86/"
PORTAGE_TMPDIR="/usr/tmp"
PORTDIR="/usr/portage/"
PORTDIR_OVERLAY="/usr/local/download/portage"
SYNC="rsync://rsync14.us.gentoo.org/gentoo-portage"
USE="X509 aalib acl apache2 bcmath berkdb bzlib calendar chroot clamav cpdflib crypt cscope ctype curl curlwrappers dba dbase dbm dbx dio dlloader doc emacs emacs-w3 exif ext-png ext-zlib fam filepro flash flatfile freetds ftp gd gdbm gif gpm guile hardened iconv idea imagemagick imap informix innodb ipalias java javamail javascript jdepend jikes jpeg justify kerberos krb4 lcms libedit libwww maildir mcal mdb mhash migemo mime mmx mnogosearch motif msession mysql mysqli nagios-dns nagios-ntp nagios-ping nagios-ssh ncurses nis nls oav oci8 odbc pam parse-clocks pcntl pdflib perl pg-hier pg-intdatetime pg-vacuumdelay php pic pie plotutils png pnp posix postgres prelude propolice python readline recode ruby samba sasl session sharedmem simplexml skey slang snmp soap sockets spell spl sqlite sse ssl svg sysvipc tcpd tetex tidy tiff tokenizer truetype usb virus-scan wddx wmf x86 xchatnogtk xchattext xface xml xml2 xmlrpc xpm xsl yaz zeo zlib"
sys-apps/file-4.06 is the currently installed version... I'll test out others...
learn to use bugzilla :P (error filed as Bug 73786)
vapier: That bug is preventing this security bug from being resolved
(regardless of whether or not you mark it 'RESOLVED' because a secure package
is not available to our users who can't emerge it.
That bug should have been resolved before this was marked stable.
eradicator: I agree this should have been fixed before if we were alerted to
the fact that there was a bug.
bug #73786: 2004-12-08 04:17 PST
GLSA: 2004-12-13 14:47 PST
The bug was filed 5 days before the GLSA was announced. base-system should have mentioned this problem here and dealt with it so the GLSA could be released...
eradicator: you're right however base-system is not on this bug and security
were only just alerted:
Tue Dec 14 07:35:43 2004
eradicator: you're right however base-system is not on this bug and security
were only just alerted:
Tue Dec 14 07:35:43 2004
http://bugs.gentoo.org/show_bug.cgi?id=72521
eradicator@gentoo.org changed:
What |Removed |Added
----------------------------------------------------------------------------
BugsThisDependsOn| |73786
