Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).

iDEFENSE discovered a buffer overflow vulnerability in the ELF format parsing of the 'file' command, one which can be used to execute arbitrary code with the privileges of the user running the command.
The vulnerability can be exploited by crafting a special ELF binary which is then input to file. This could be accomplished by leaving the binary on the file system and waiting for someone to use file to identify it, or by passing it to a service that uses file to classify input. (For example, some printer filters run file to determine how to process input going to a printer.)

Fixed packages are available in version 3.28-1.potato.1 for Debian 2.2 (potato) and version 3.37-3.1.woody.1 for Debian 3.0 (woody). We recommend you upgrade your file package immediately.

A memory allocation problem in file was found by Jeff Johnson, and a stack overflow corruption problem was found by David Endler. These problems have been corrected in file version 3.41 and likely affect all previous version. These problems pose a security threat as they can be used to execute arbitrary code by an attacker under the privileges of another user. Note that the attacker must first somehow convince the target user to execute file against a specially crafted file that triggers the buffer overflow in file.

Update :

The 8.2 and 9.0 packages installed data in a different directory than where they should have been installed, which broke compatability with a small number of programs. These updated packages place those files back in the appropriate location.

The remote host is missing the patch for the advisory SUSE-SA:2003:017 (file).


The file command can be used to determine the type of files.
iDEFENSE published a security report about a buffer overflow in the handling-routines for the ELF file-format.
In conjunction with other mechanisms like print-filters, cron-jobs, eMail-scanners (like AMaViS) and alike this vulnerability can be used to gain higher privileges or to compromise the system remotely.

There is no temporary fix known other then updating the system.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Updated file packages are available to close a buffer overflow vulnerability.

[Updated 12 March 2003] Added packages for Red Hat Enterprise Linux ES and Red Hat Enterprise Linux WS

The file command is used to identify a particular file according to the type of data contained by the file.

The file utility before version 3.41 contains a buffer overflow vulnerability in the ELF parsing routines. This vulnerability may allow an attacker to create a carefully crafted binary which can cause arbitrary code to run if a victim runs the file command against that binary.

On some distributions it may also be possible to trigger this file command vulnerability by encouraging the victim to use the less command on an exploited file name so that it will be processed by the lesspipe.sh script.

All users are advised to update to these erratum packages which contain a backported patch to correct this vulnerability.

Red Hat would like to thank iDefense for disclosing this issue and zen-parse for discussion of some of the implications.

ID	Name	Product	Family	Severity
15097	Debian DSA-260-1 : file - buffer overflow	Nessus	Debian Local Security Checks	medium
14014	Mandrake Linux Security Advisory : file (MDKSA-2003:030-1)	Nessus	Mandriva Local Security Checks	medium
13787	SUSE-SA:2003:017: file	Nessus	SuSE Local Security Checks	high
12376	RHEL 2.1 : file (RHSA-2003:087)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2003-0102

critical

Tenable Plugins

medium

medium

high

medium