blob: 8edec1b2ed24ddbb89b8506c3cbffa6b93780100 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
libelf: Fix dir traversal vuln in ar extraction.
read_long_names terminates names at the first '/' found but
then skips one character without checking (it's supposed to
be '\n'). Hence the next name could start with any character
including '/'. This leads to a directory traversal vulnerability
at the time the contents of the archive is extracted.
The danger is mitigated by the fact that only one '/' is
possible in a resulting filename and only in the leading position.
Hence only files in the root directory can be written via this vuln
and only when ar is executed as root. The fix for the vuln is to not
skip any characters while looking for '/'.
Upstream commit:
https://git.fedorahosted.org/cgit/elfutils.git/commit/
?id=147018e729e7c22eeabf15b82d26e4bf68a0d18e
Fixes CVE-2014-9447
Upstream-Status: Backport
Signed-off-by: Alexander Cherepanov <cherepan@mccme.ru>
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
---
diff -ruN a/libelf/ChangeLog b/libelf/ChangeLog
--- a/libelf/ChangeLog 2015-03-03 10:45:03.586045753 +0100
+++ b/libelf/ChangeLog 2015-03-03 10:47:14.052545814 +0100
@@ -1,3 +1,8 @@
+2014-12-28 Alexander Cherepanov <cherepan@mccme.ru>
+
+ * elf_begin.c (read_long_names): Don't miss '/' right after
+ another '/'. Fixes a dir traversal vuln in ar extraction.
+
2010-06-14 Ulrich Drepper <drepper@redhat.com>
* gelf_update_shdr.c: Implicitly set ELF_F_DIRTY bit.
diff -ruN a/libelf/elf_begin.c b/libelf/elf_begin.c
--- a/libelf/elf_begin.c 2015-03-03 10:45:04.414010849 +0100
+++ b/libelf/elf_begin.c 2015-03-03 10:45:46.736226750 +0100
@@ -765,10 +765,7 @@
break;
/* NUL-terminate the string. */
- *runp = '\0';
-
- /* Skip the NUL byte and the \012. */
- runp += 2;
+ *runp++ = '\0';
/* A sanity check. Somebody might have generated invalid
archive. */
|
