binutils Multiple Directory Traversal Vulnerabilities

Bugtraq ID:	70908
Class:	Input Validation Error
CVE:	CVE-2014-8737
Remote:	Yes
Local:	No
Published:	Nov 05 2014 12:00AM
Updated:	Jul 06 2016 01:37PM
Credit:	Alexander Cherepanov
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Oracle Linux 0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

binutils Multiple Directory Traversal Vulnerabilities

binutils is prone to multiple directory-traversal vulnerabilities.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to read arbitrary files in the context of the application. This may aid in further attacks.

binutils Multiple Directory Traversal Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].


Mandriva Business Server 1 X86 64

• Mandriva binutils-2.22-4.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64binutils-devel-2.22-4.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

binutils Multiple Directory Traversal Vulnerabilities

References:

• strip/objcopy: directory traversal (Alexander Cherepanov)
  
• GNU Homepage (binutils)
  
• objdump/ar/... crash on malformed ar file (Alexander Cherepanov)
  
• isg3T1023355 : Multiple vulnerabilities in Gnu binutils affect PowerKVM (IBM)
  
• Ref: linuxbulletinoct2015-2719645 Oracle Linux Bulletin - October 2015 Revision (Oracle)