e2fsprogs CVE-2015-1572 Incomplete Fix Local Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	72709
Class:	Input Validation Error
CVE:	CVE-2015-1572
Remote:	No
Local:	Yes
Published:	Feb 11 2015 12:00AM
Updated:	Aug 12 2015 10:12PM
Credit:	Nick Kralevich
Vulnerable:	Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Gentoo Linux e2fsprogs e2fsprogs 1.40.2 e2fsprogs e2fsprogs 1.40.1 e2fsprogs e2fsprogs 1.40 e2fsprogs e2fsprogs 1.39 e2fsprogs e2fsprogs 1.38 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

e2fsprogs CVE-2015-1572 Incomplete Fix Local Heap Based Buffer Overflow Vulnerability

e2fsprogs is prone to a local heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Local attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

Note: This issue is the result of an incomplete fix for the issue described in BID 72520 (e2fsprogs 'lib/ext2fs/openfs.c' Local Heap Based Buffer Overflow Vulnerability).

e2fsprogs CVE-2015-1572 Incomplete Fix Local Heap Based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

e2fsprogs CVE-2015-1572 Incomplete Fix Local Heap Based Buffer Overflow Vulnerability

References:

• E2fsprogs Homepage (E2fsprogs)