Multiple integer overflows in libext2fs in e2fsprogs before 1.40.3 allow user-assisted remote attackers to execute arbitrary code via a crafted filesystem image.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has e2fsprogs packages installed that are affected by a vulnerability:

  - Multiple integer overflows in libext2fs in e2fsprogs before 1.40.3 allow user-assisted remote attackers to     execute arbitrary code via a crafted filesystem image. (CVE-2007-5497)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0003 advisory.

    [1.32-15.4]
     - Fix integer overflows (#414611 / CVE-2007-5497)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple integer overflow flaws were found in the way e2fsprogs processes file system content. If a victim opens a carefully crafted file system with a program using e2fsprogs, it may be possible to execute arbitrary code with the permissions of the victim. It may be possible to leverage this flaw in a virtualized environment to gain access to other virtualized hosts. (CVE-2007-5497)

This update of e2fsprogs fixes several integer overflows in memory allocating code. Programs that use libext2fs are therefore vulnerable to memory corruptions that can lead to arbitrary code execution while loading a specially crafted image. (CVE-2007-5497)

Updated e2fsprogs package address multiple integer overflow flaws

Thanks to Rafal Wojtczuk of McAfee Avert Research for identifying and reporting this issue.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-5497 to this issue.

This update fixes :

  - Bug #414571 - CVE-2007-5497 e2fsprogs multiple integer     overflows [F7]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes :

  - Bug #414581 - CVE-2007-5497 e2fsprogs multiple integer     overflows [F8]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated e2fsprogs packages that fix several security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The e2fsprogs packages contain a number of utilities for creating, checking, modifying, and correcting any inconsistencies in second and third extended (ext2/ext3) file systems.

Multiple integer overflow flaws were found in the way e2fsprogs processes file system content. If a victim opens a carefully crafted file system with a program using e2fsprogs, it may be possible to execute arbitrary code with the permissions of the victim. It may be possible to leverage this flaw in a virtualized environment to gain access to other virtualized hosts. (CVE-2007-5497)

Red Hat would like to thank Rafal Wojtczuk of McAfee Avert Research for responsibly disclosing these issues.

Users of e2fsprogs are advised to upgrade to these updated packages, which contain a backported patch to resolve these issues.

Theodore Y. Ts'o reports :

Fix a potential security vulnerability where an untrusted filesystem can be corrupted in such a way that a program using libext2fs will allocate a buffer which is far too small. This can lead to either a crash or potentially a heap-based buffer overflow crash. No known exploits exist, but main concern is where an untrusted user who possesses privileged access in a guest Xen environment could corrupt a filesystem which is then accessed by thus allowing the untrusted user to gain privileged access in the host OS. Thanks to the McAfee AVERT Research group for reporting this issue.

The remote host is affected by the vulnerability described in GLSA-200712-13 (E2fsprogs: Multiple buffer overflows)

    Rafal Wojtczuk (McAfee AVERT Research) discovered multiple integer     overflows in libext2fs, that are triggered when processing information     from within the file system, resulting in heap-based buffer overflows.
  Impact :

    An attacker could entice a user to process a specially crafted ext2 or     ext3 file system image (with tools linking against libext2fs, e.g.
    fsck, forensic tools or Xen's pygrub), possibly resulting in the     execution of arbitrary code with the privileges of the user running the     application.
  Workaround :

    There is no known workaround at this time.

Rafal Wojtczuk discovered multiple integer overflows in e2fsprogs. If a user or automated system were tricked into fscking a malicious ext2/ext3 filesystem, a remote attacker could execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Rafal Wojtczuk of McAfee AVERT Research found that e2fsprogs contained multiple integer overflows in memory allocations, based on sizes taken directly from filesystem information. These flaws could result in heap-based overflows potentially allowing for the execution of arbitrary code.

The updated packages have been patched to correct these issues.

Rafal Wojtczuk of McAfee AVERT Research discovered that e2fsprogs, the ext2 file system utilities and libraries, contained multiple integer overflows in memory allocations, based on sizes taken directly from filesystem information. These could result in heap-based overflows potentially allowing the execution of arbitrary code.

ID	Name	Product	Family	Severity
147298	NewStart CGSL CORE 5.04 / MAIN 5.04 : e2fsprogs Vulnerability (NS-SA-2021-0005)	Nessus	NewStart CGSL Local Security Checks	high
67630	Oracle Linux 5 : Moderate: / e2fsprogs (ELSA-2008-0003)	Nessus	Oracle Linux Local Security Checks	critical
60340	Scientific Linux Security Update : e2fsprogs on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41177	SuSE9 Security Update : e2fsprogs (YOU Patch Number 12019)	Nessus	SuSE Local Security Checks	medium
41168	SuSE9 Security Update : e2fsprogs (YOU Patch Number 11997)	Nessus	SuSE Local Security Checks	medium
40375	VMSA-2008-0004 : Low: Updated e2fsprogs service console package	Nessus	VMware ESX Local Security Checks	medium
30026	Fedora 7 : e2fsprogs-1.40.2-3.fc7 (2007-4461)	Nessus	Fedora Local Security Checks	medium
30025	Fedora 8 : e2fsprogs-1.40.2-12.fc8 (2007-4447)	Nessus	Fedora Local Security Checks	medium
29901	CentOS 3 / 4 / 5 : e2fsprogs (CESA-2008:0003)	Nessus	CentOS Local Security Checks	medium
29876	RHEL 2.1 / 3 / 4 / 5 : e2fsprogs (RHSA-2008:0003)	Nessus	Red Hat Local Security Checks	medium
29769	FreeBSD : e2fsprogs -- heap buffer overflow (299e3f81-aee7-11dc-b781-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium
29733	GLSA-200712-13 : E2fsprogs: Multiple buffer overflows	Nessus	Gentoo Local Security Checks	medium
29415	SuSE 10 Security Update : e2fsprogs (ZYPP Patch Number 4743)	Nessus	SuSE Local Security Checks	medium
29305	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : e2fsprogs vulnerability (USN-555-1)	Nessus	Ubuntu Local Security Checks	medium
29299	Mandrake Linux Security Advisory : e2fsprogs (MDKSA-2007:242)	Nessus	Mandriva Local Security Checks	medium
29257	Debian DSA-1422-1 : e2fsprogs - integer overflows	Nessus	Debian Local Security Checks	medium
29243	openSUSE 10 Security Update : e2fsprogs (e2fsprogs-4739)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2007-5497

critical

Tenable Plugins

high

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium