Integer overflow in the Binary File Descriptor (BFD) library for gdb before 6.3, binutils, elfutils, and possibly other packages, allows user-assisted attackers to execute arbitrary code via a crafted object file that specifies a large number of section headers, leading to a heap-based buffer overflow.

An update of the crash package has been released.

An updated gdb package that fixes several bugs and minor security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GDB, the GNU debugger, allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion, then printing their data.

Several integer overflow bugs were found in gdb. If a user is tricked into processing a specially crafted executable file, it may allow the execution of arbitrary code as the user running gdb. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1704 to this issue.

A bug was found in the way gdb loads .gdbinit files. When a user executes gdb, the local directory is searched for a .gdbinit file which is then loaded. It is possible for a local user to execute arbitrary commands as the victim running gdb by placing a malicious .gdbinit file in a location where gdb may be run. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1705 to this issue.

This updated package also addresses the following issues :

  - GDB on ia64 had previously implemented a bug fix to     work-around a kernel problem when creating a core file     via gcore. The bug fix caused a significant slow-down of     gcore.

  - GDB on ia64 issued an extraneous warning when gcore was     used.

  - GDB on ia64 could not backtrace over a sigaltstack.

  - GDB on ia64 could not successfully do an info frame for     a signal trampoline.

  - GDB on AMD64 and Intel EM64T had problems attaching to a     32-bit process.

  - GDB on AMD64 and Intel EM64T was not properly handling     threaded watchpoints.

  - GDB could not build with gcc4 when -Werror flag was set.

  - GDB had problems printing inherited members of C++     classes.

  - A few updates from mainline sources concerning Dwarf2     partial die in cache support, follow-fork support,     interrupted syscall support, and DW_OP_piece read     support.

All users of gdb should upgrade to this updated package, which resolves these issues.

An updated binutils package that fixes several bugs and minor security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Binutils is a collection of utilities used for the creation of executable code. A number of bugs were found in various binutils tools.

If a user is tricked into processing a specially crafted executable with utilities such as readelf, size, strings, objdump, or nm, it may allow the execution of arbitrary code as the user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1704 to this issue.

In addition, the following bugs have been fixed :

-- by default issue an error if IA-64 hint@pause instruction is put into the B slot, add assembler command line switch to override this behaviour -- fix linker's --emit-relocs with .gnu.warning.* section symbols -- fix gprof on 64-bit ppc binaries and libraries -- fix gas mapping of register names to dwarf2 register numbers in CFI directives

All users of binutils should upgrade to this updated package, which contains patches to resolve these issues.

Updated elfutils packages that address a minor security issue and various other issues are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The elfutils packages contain a number of utility programs and libraries related to the creation and maintenance of executable code.

The elfutils packages that originally shipped with Red Hat Enterprise Linux 4 were GPL-licensed versions which lacked some functionality.
Previous updates provided fully functional versions of elfutils only under the OSL license. This update provides a fully functional, GPL-licensed version of elfutils.

In the OSL-licensed elfutils versions provided in previous updates, some tools could sometimes crash when given corrupted input files.
(CVE-2005-1704)

Also, when the eu-strip tool was used to create separate debuginfo files from relocatable objects such as kernel modules (.ko), the resulting debuginfo files (.ko.debug) were sometimes corrupted. Both of these problems are fixed in the new version.

Users of elfutils should upgrade to these updated packages, which resolve these issues.

Updated elfutils packages that address a minor security issue and various other issues are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The elfutils packages contain a number of utility programs and libraries related to the creation and maintenance of executable code.

The elfutils packages that originally shipped with Red Hat Enterprise Linux 3 were GPL-licensed versions which lacked some functionality.
Previous updates provided fully functional versions of elfutils only under the OSL license. This update provides a fully functional, GPL-licensed version of elfutils.

In the OSL-licensed elfutils versions provided in previous updates, some tools could sometimes crash when given corrupted input files.
(CVE-2005-1704)

Also, when the eu-strip tool was used to create separate debuginfo files from relocatable objects such as kernel modules (.ko), the resulting debuginfo files (.ko.debug) were sometimes corrupted. Both of these problems are fixed in the new version.

Users of elfutils should upgrade to these updated packages, which resolve these issues.

An updated binutils package that fixes several bugs and minor security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Binutils is a collection of utilities used for the creation of executable code. A number of bugs were found in various binutils tools.

Several integer overflow bugs were found in binutils. If a user is tricked into processing a specially crafted executable with utilities such as readelf, size, strings, objdump, or nm, it may allow the execution of arbitrary code as the user running the utility. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1704 to this issue.

Additionally, the following bugs have been fixed :

-- correct alignment of .tbss section if the requested alignment of .tbss is bigger than requested alignment of .tdata section -- by default issue an error if IA-64 hint@pause instruction is put into the B slot, add assembler command line switch to override this behaviour

All users of binutils should upgrade to this updated package, which contains backported patches to resolve these issues.

Tavis Ormandy found an integer overflow in the Binary File Descriptor (BFD) parser in the GNU debugger. The same vulnerable code is also present in binutils. By tricking an user into processing a specially crafted executable with the binutils tools (strings, objdump, nm, readelf, etc.), an attacker could exploit this to execute arbitrary code with the privileges of the user running the affected program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tavis Ormandy found an integer overflow in the GNU debugger. By tricking an user into merely load a specially crafted executable, an attacker could exploit this to execute arbitrary code with the privileges of the user running gdb. However, loading untrusted binaries without actually executing them is rather uncommon, so the risk of this flaw is low. (CAN-2005-1704)

Tavis Ormandy also discovered that gdb loads and executes the file '.gdbinit' in the current directory even if the file belongs to a different user. By tricking an user into run gdb in a directory with a malicious .gdbinit file, a local attacker could exploit this to run arbitrary commands with the privileges of the user invoking gdb.
(CAN-2005-1705).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Integer overflows in various applications in the binutils package may allow attackers to execute arbitrary code via a carefully crafted object file.

The updated packages have been patched to help address these problems.

An updated gdb package that fixes minor security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GDB, the GNU debugger, allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion, then printing their data.

Several integer overflow bugs were found in gdb. If a user is tricked into processing a specially crafted executable file, it may allow the execution of arbitrary code as the user running gdb. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1704 to this issue.

A bug was found in the way gdb loads .gdbinit files. When a user executes gdb, the local directory is searched for a .gdbinit file which is then loaded. It is possible for a local user to execute arbitrary commands as the user running gdb by placing a malicious .gdbinit file in a location where gdb may be run. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1705 to this issue.

All users of gdb should upgrade to this updated package, which contains backported patches that resolve these issues.

An updated binutils package that fixes minor security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Binutils is a collection of utilities used for the creation of executable code. A number of bugs were found in various binutils tools.

Several integer overflow bugs were found in binutils. If a user is tricked into processing a specially crafted executable with utilities such as readelf, size, strings, objdump, or nm, it may allow the execution of arbitrary code as the user running the utility. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1704 to this issue.

All users of binutils should upgrade to this updated package, which contains backported patches to resolve these issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:709 advisory.

    GDB, the GNU debugger, allows debugging of programs written in C, C++,     and other languages by executing them in a controlled fashion, then     printing their data.

    Several integer overflow bugs were found in gdb. If a user is tricked     into processing a specially crafted executable file, it may allow the     execution of arbitrary code as the user running gdb. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2005-1704 to this issue.

    A bug was found in the way gdb loads .gdbinit files. When a user executes     gdb, the local directory is searched for a .gdbinit file which is then     loaded. It is possible for a local user to execute arbitrary commands as     the victim running gdb by placing a malicious .gdbinit file in a location     where gdb may be run. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-1705 to this issue.

    This updated package also addresses the following issues:

    - GDB on ia64 had previously implemented a bug fix to work-around a kernel     problem when creating a core file via gcore.  The bug fix caused a     significant slow-down of gcore.

    - GDB on ia64 issued an extraneous warning when gcore was used.

    - GDB on ia64 could not backtrace over a sigaltstack.

    - GDB on ia64 could not successfully do an info frame for a signal trampoline.

    - GDB on AMD64 and Intel EM64T had problems attaching to a 32-bit process.

    - GDB on AMD64 and Intel EM64T was not properly handling threaded watchpoints.

    - GDB could not build with gcc4 when -Werror flag was set.

    - GDB had problems printing inherited members of C++ classes.

    - A few updates from mainline sources concerning Dwarf2 partial die in     cache support, follow-fork support, interrupted syscall support, and     DW_OP_piece read support.

    All users of gdb should upgrade to this updated package, which resolves     these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:673 advisory.

    Binutils is a collection of utilities used for the creation of executable     code. A number of bugs were found in various binutils tools.

    If a user is tricked into processing a specially crafted executable with     utilities such as readelf, size, strings, objdump, or nm, it may allow the     execution of arbitrary code as the user. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-1704 to     this issue.

    In addition, the following bugs have been fixed:

    -- by default issue an error if IA-64 hint@pause instruction is        put into the B slot, add assembler command line switch to        override this behaviour
    -- fix linker's --emit-relocs with .gnu.warning.* section symbols
    -- fix gprof on 64-bit ppc binaries and libraries
    -- fix gas mapping of register names to dwarf2 register numbers        in CFI directives

    All users of binutils should upgrade to this updated package, which     contains patches to resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200506-01 (Binutils, elfutils: Buffer overflow)

    Tavis Ormandy and Ned Ludd of the Gentoo Linux Security Audit Team     discovered an integer overflow in the BFD library and elfutils,     resulting in a heap based buffer overflow.
  Impact :

    Successful exploitation would require a user to access a specially     crafted binary file, resulting in the execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

Tavis Ormandy of the Gentoo Linux Security Audit Team discovered two vulnerabilities in the GNU debugger. The first allows an attacker to execute arbitrary code with the privileges of the user running gdb if they can trick the user into loading a specially crafted executable (CVE-2005-1704).

He also discovered that gdb loads and executes the file .gdbinit in the current directory even if the file belongs to a different user. If a user can be tricked into running gdb in a directory with a malicious .gdbinit file, a local attacker can exploit this to run arbitrary commands with the privileges of the user running gdb (CVE-2005-1705).

The updated packages have been patched to correct these problems.

The remote host is affected by the vulnerability described in GLSA-200505-15 (gdb: Multiple vulnerabilities)

    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered an     integer overflow in the BFD library, resulting in a heap overflow. A     review also showed that by default, gdb insecurely sources     initialisation files from the working directory.
  Impact :

    Successful exploitation would result in the execution of arbitrary code     on loading a specially crafted object file or the execution of     arbitrary commands.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	critical
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	critical
67033	CentOS 4 : gdb (CESA-2005:709)	Nessus	CentOS Local Security Checks	high
67030	CentOS 4 : binutils (CESA-2005:673)	Nessus	CentOS Local Security Checks	medium
22274	CentOS 4 : elfutils (CESA-2006:0354)	Nessus	CentOS Local Security Checks	medium
22219	RHEL 4 : elfutils (RHSA-2006:0354)	Nessus	Red Hat Local Security Checks	medium
22085	RHEL 3 : elfutils (RHSA-2006:0368)	Nessus	Red Hat Local Security Checks	medium
22082	CentOS 3 : elfutils (CESA-2006:0368)	Nessus	CentOS Local Security Checks	medium
21848	CentOS 3 : binutils (CESA-2005:659)	Nessus	CentOS Local Security Checks	medium
20527	Ubuntu 4.10 / 5.04 : binutils vulnerability (USN-136-1)	Nessus	Ubuntu Local Security Checks	medium
20526	Ubuntu 4.10 / 5.04 : gdb vulnerabilities (USN-135-1)	Nessus	Ubuntu Local Security Checks	high
20447	Mandrake Linux Security Advisory : binutils (MDKSA-2005:215)	Nessus	Mandriva Local Security Checks	medium
20059	RHEL 2.1 : gdb (RHSA-2005:801)	Nessus	Red Hat Local Security Checks	high
20045	RHEL 2.1 : binutils (RHSA-2005:763)	Nessus	Red Hat Local Security Checks	medium
19994	RHEL 4 : gdb (RHSA-2005:709)	Nessus	Red Hat Local Security Checks	high
19991	RHEL 4 : binutils (RHSA-2005:673)	Nessus	Red Hat Local Security Checks	high
19831	RHEL 3 : binutils (RHSA-2005:659)	Nessus	Red Hat Local Security Checks	medium
18406	GLSA-200506-01 : Binutils, elfutils: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
18404	Mandrake Linux Security Advisory : gdb (MDKSA-2005:095)	Nessus	Mandriva Local Security Checks	high
18379	GLSA-200505-15 : gdb: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-1704

high

Tenable Plugins

critical

critical

high

medium

medium

medium

medium

medium

medium

medium

high

medium

high

medium

high

high

medium

medium

high

high