e2fsprogs 'lib/ext2fs/openfs.c' Local Heap Based Buffer Overflow Vulnerability
BID:72520
Info
e2fsprogs 'lib/ext2fs/openfs.c' Local Heap Based Buffer Overflow Vulnerability
| Bugtraq ID: | 72520 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-0247 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 29 2015 12:00AM |
| Updated: | Jan 12 2017 06:08AM |
| Credit: | Jose Duart of Google Security Team. |
| Vulnerable: |
Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Gentoo Linux e2fsprogs e2fsprogs 1.40.2 e2fsprogs e2fsprogs 1.40.1 e2fsprogs e2fsprogs 1.40 e2fsprogs e2fsprogs 1.39 e2fsprogs e2fsprogs 1.38 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
e2fsprogs e2fsprogs 1.42.12 |
Discussion
e2fsprogs 'lib/ext2fs/openfs.c' Local Heap Based Buffer Overflow Vulnerability
e2fsprogs is prone to a local heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
Local attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.
Versions prior to e2fsprogs 1.42.12 are vulnerable.
e2fsprogs is prone to a local heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
Local attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.
Versions prior to e2fsprogs 1.42.12 are vulnerable.
Exploit / POC
e2fsprogs 'lib/ext2fs/openfs.c' Local Heap Based Buffer Overflow Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
e2fsprogs 'lib/ext2fs/openfs.c' Local Heap Based Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
-
Mandriva e2fsprogs-1.42.2-3.1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64ext2fs-devel-1.42.2-3.1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64ext2fs2-1.42.2-3.1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/
References
e2fsprogs 'lib/ext2fs/openfs.c' Local Heap Based Buffer Overflow Vulnerability
References:
References: