Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this issue is due to an incorrect patch for CVE-2007-1536.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2007-0391 advisory.

    [4.10-3.0.2]
     - resolves: #241026: CVE-2007-2799 file integer overflow
     - added dependency on zlib-devel

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The fix for CVE-2007-1536 introduced a new integer underflow flaw in the file utility. An attacker could create a carefully crafted file which, if examined by a victim using the file utility, could lead to arbitrary code execution. (CVE-2007-2799)

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

This update fixes an integer overflow in function file_printf() of file. This bug can be used to execute arbitrary code. (CVE-2007-2799)

USN-439-1 fixed a vulnerability in file. The original fix did not fully solve the problem. This update provides a more complete solution.

Jean-Sebastien Guay-Leroux discovered that 'file' did not correctly check the size of allocated heap memory. If a user were tricked into examining a specially crafted file with the 'file' utility, a remote attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to new upstream 4.21 should also fix CVE-2007-2799 file integer overflow

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200710-19 (The Sleuth Kit: Integer underflow)

    Jean-Sebastien Guay-Leroux reported an integer underflow in the     file_printf() function of the 'file' utility which is bundled with The     Sleuth Kit (CVE-2007-1536, GLSA 200703-26). Note that Gentoo is not     affected by the improper fix for this vulnerability (identified as     CVE-2007-2799, see GLSA 200705-25) since version 4.20 of 'file' was     never shipped with The Sleuth Kit ebuilds.
  Impact :

    A remote attacker could entice a user to run The Sleuth Kit on a file     system containing a specially crafted file that would trigger a     heap-based buffer overflow possibly leading to the execution of     arbitrary code with the rights of the user running The Sleuth Kit.
  Workaround :

    There is no known workaround at this time.

Colin Percival discovered an integer overflow in file, a file type classification tool, which may lead to the execution of arbitrary code.

The update to correct CVE-2007-1536 (MDKSA-2007:067), a buffer overflow in the file_printf() function, introduced a new integer overflow as reported by Colin Percival. This flaw, if an attacker could trick a user into running file on a specially crafted file, could possibly lead to the execution of arbitrary code with the privileges of the user running file (CVE-2007-2799).

As well, in file 4.20, flawed regular expressions to identify OS/2 REXX files could lead to a denial of service via CPU consumption (CVE-2007-2026).

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200705-25 (file: Integer overflow)

    Colin Percival from FreeBSD reported that the previous fix for the     file_printf() buffer overflow introduced a new integer overflow.
  Impact :

    A remote attacker could entice a user to run the file program on an     overly large file (more than 1Gb) that would trigger an integer     overflow on 32-bit systems, possibly leading to the execution of     arbitrary code with the rights of the user running file.
  Workaround :

    There is no known workaround at this time.

An updated file package that fixes a security flaw is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The file command is used to identify a particular file according to the type of data contained by the file.

The fix for CVE-2007-1536 introduced a new integer underflow flaw in the file utility. An attacker could create a carefully crafted file which, if examined by a victim using the file utility, could lead to arbitrary code execution. (CVE-2007-2799)

This issue did not affect the version of the file utility distributed with Red Hat Enterprise Linux 2.1 or 3.

Users should upgrade to this erratum package, which contain a backported patch to correct this issue.

ID	Name	Product	Family	Severity
67507	Oracle Linux 5 : Moderate: / file (ELSA-2007-0391)	Nessus	Oracle Linux Local Security Checks	high
60191	Scientific Linux Security Update : file on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
29428	SuSE 10 Security Update : file (ZYPP Patch Number 3755)	Nessus	SuSE Local Security Checks	medium
28036	Ubuntu 6.06 LTS / 6.10 / 7.04 : file vulnerability (USN-439-2)	Nessus	Ubuntu Local Security Checks	medium
27681	Fedora 7 : file-4.21-1.fc7 (2007-0836)	Nessus	Fedora Local Security Checks	medium
27517	GLSA-200710-19 : The Sleuth Kit: Integer underflow	Nessus	Gentoo Local Security Checks	high
27216	openSUSE 10 Security Update : file (file-3757)	Nessus	SuSE Local Security Checks	medium
25826	Debian DSA-1343-1 : file - integer overflow	Nessus	Debian Local Security Checks	medium
25439	Mandrake Linux Security Advisory : file (MDKSA-2007:114)	Nessus	Mandriva Local Security Checks	high
25384	GLSA-200705-25 : file: Integer overflow	Nessus	Gentoo Local Security Checks	medium
25364	RHEL 4 / 5 : file (RHSA-2007:0391)	Nessus	Red Hat Local Security Checks	medium
25355	CentOS 4 / 5 : file (CESA-2007:0391)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-2799

high

Tenable Plugins

high

high

critical

medium

medium

medium

high

medium

medium

high

medium

medium

medium