Encrypted Virtual Filesystem Local Heap Overrun Vulnerability

Bugtraq ID:	7679
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	May 24 2003 12:00AM
Updated:	May 24 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to Paul Lasarev <[email protected]>.
Vulnerable:	sd Encrypted Virtual Filesystem 0.2
Not Vulnerable:	sd Encrypted Virtual Filesystem 0.3

Encrypted Virtual Filesystem Local Heap Overrun Vulnerability

A vulnerability has been discovered in the 'efs' utility used by the Encrypted Virtual Filesystem (EVFS). The problem occurs due to insufficient size calculations while allocated heap memory. As a result, an attacker may be capable of corrupting sensitive memory and potentially executing commands. All instructions executed in this manner would be run with root privileges.

Encrypted Virtual Filesystem Local Heap Overrun Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Encrypted Virtual Filesystem Local Heap Overrun Vulnerability

Solution:
EVFS 0.3 has been released to address this issue. Users are advised to upgrade as soon as possible.


sd Encrypted Virtual Filesystem 0.2

• sd EVFS 3.0
  http://hysteria.sk/evfs/f/evfs-0.3.tgz

Encrypted Virtual Filesystem Local Heap Overrun Vulnerability

References:

• Encrypted Virtual Filesystem (sd)