Directory traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a non-initial pathname component in a filename within a .jar archive, a related issue to CVE-2005-1080. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - fastjar: directory traversal vulnerabilities (CVE-2010-0831, CVE-2010-2322)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0025 advisory.

    - fix up fastjar directory traversal bugs (CVE-2010-0831)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This fastjar update fixes a directory traversal issue. (bnc#607043)

The remote host is affected by the vulnerability described in GLSA-201209-21 (fastjar: Directory traversal)

    Two directory traversal vulnerabilities have been discovered in fastjar.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted JAR       file, possibly resulting in the creation or truncation of arbitrary       files.
  Workaround :

    There is no known workaround at this time.

Two directory traversal flaws were found in the way fastjar extracted JAR archive files. If a local, unsuspecting user extracted a specially crafted JAR file, it could cause fastjar to overwrite arbitrary files writable by the user running fastjar. (CVE-2010-0831, CVE-2010-2322)

This update also fixes the following bugs :

  - The option -print-multi-os-directory in the gcc --help     output is not in the gcc(1) man page. This update     applies an upstream patch to amend this. (BZ#529659)

  - An internal assertion in the compiler tried to check     that a C++ static data member is external which resulted     in errors. This was because when the compiler optimizes     C++ anonymous namespaces the declarations were no longer     marked external as everything on anonymous namespaces is     local to the current translation. This update corrects     the assertion to resolve this issue. (BZ#503565,     BZ#508735, BZ#582682)

  - Attempting to compile certain .cpp files could have     resulted in an internal compiler error. This update     resolves this issue. (BZ#527510)

  - PrintServiceLookup.lookupPrintServices with an     appropriate DocFlavor failed to return a list of     printers under gcj. This update includes a backported     patch to correct this bug in the printer lookup service.
    (BZ#578382)

  - GCC would not build against xulrunner-devel-1.9.2. This     update removes gcjwebplugin from the GCC RPM.
    (BZ#596097)

  - When a SystemTap generated kernel module was compiled,     gcc reported an internal compiler error and gets a     segmentation fault. This update applies a patch that,     instead of crashing, assumes it can point to anything.
    (BZ#605803)

  - There was a performance issue with libstdc++ regarding     all objects derived from or using std::streambuf because     of lock contention between threads. This patch ensures     reload uses the same value from _S_global for the     comparison, _M_add_reference () and _M_impl member of     the class. (BZ#635708)

Updated gcc packages that fix two security issues and several compiler bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The gcc packages include C, C++, Java, Fortran, Objective C, and Ada 95 GNU compilers, along with related support libraries. The libgcj package provides fastjar, an archive tool for Java Archive (JAR) files.

Two directory traversal flaws were found in the way fastjar extracted JAR archive files. If a local, unsuspecting user extracted a specially crafted JAR file, it could cause fastjar to overwrite arbitrary files writable by the user running fastjar. (CVE-2010-0831, CVE-2010-2322)

This update also fixes the following bugs :

* The option -print-multi-os-directory in the gcc --help output is not in the gcc(1) man page. This update applies an upstream patch to amend this. (BZ#529659)

* An internal assertion in the compiler tried to check that a C++ static data member is external which resulted in errors. This was because when the compiler optimizes C++ anonymous namespaces the declarations were no longer marked external as everything on anonymous namespaces is local to the current translation. This update corrects the assertion to resolve this issue. (BZ#503565, BZ#508735, BZ#582682)

* Attempting to compile certain .cpp files could have resulted in an internal compiler error. This update resolves this issue. (BZ#527510)

* PrintServiceLookup.lookupPrintServices with an appropriate DocFlavor failed to return a list of printers under gcj. This update includes a backported patch to correct this bug in the printer lookup service.
(BZ#578382)

* GCC would not build against xulrunner-devel-1.9.2. This update removes gcjwebplugin from the GCC RPM. (BZ#596097)

* When a SystemTap generated kernel module was compiled, gcc reported an internal compiler error and gets a segmentation fault. This update applies a patch that, instead of crashing, assumes it can point to anything. (BZ#605803)

* There was a performance issue with libstdc++ regarding all objects derived from or using std::streambuf because of lock contention between threads. This patch ensures reload uses the same value from
_S_global for the comparison, _M_add_reference () and _M_impl member of the class. (BZ#635708)

All gcc users should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Fedora host is missing one or more security updates :

gcc-4.4.4-10.fc12 :

  - Wed Jun 30 2010 Jakub Jelinek <jakub at redhat.com>     4.4.4-10

    - update from gcc-4_4-branch

    - PRs fortran/43841, fortran/43843,       tree-optimization/44683

    - fix qualified-id as template argument handling       (#605761, PR c++/44587)

    - -Wunused-but-set-* static_cast fix (PR c++/44682)

    - VTA backports

    - PRs debug/44610, debug/44668, debug/44694

    - unswitching fixes (PR middle-end/43866)

    - Thu Jun 24 2010 Jakub Jelinek <jakub at redhat.com>       4.4.4-9

    - update from gcc-4_4-branch

    - PRs bootstrap/44426, bootstrap/44544, c++/44627,       fortran/44536, libgcj/44216, target/39690,       target/43740, target/44261, target/44481,       target/44534, target/44615, testsuite/32843,       testsuite/43739, tree-optimization/44508

  - VTA backports

    - PRs debug/43650, debug/44181, debug/44247

    - -Wunused-but-set-* ->*/.* fix (PR c++/44619)

    - undeprecate #ident and #sccs (#606069)

    - fixup dates in generated man pages even for fastjar       and gcc/ man pages

    - don't realign stack on x86/x86-64 just because a       DECL_ALIGN was set too high by expansion code       (#603924, PR target/44542)

  - don't allow side-effects in inline-asm memory operands     unless < or > is present in operand's constraint     (#602359, PR middle-end/44492)

  - Fri Jun 11 2010 Jakub Jelinek <jakub at redhat.com>     4.4.4-8

    - update from gcc-4_4-branch

    - fix demangler (PR other/43838)

    - VTA backports

    - further var-tracking speedup (#598310, PR debug/41371)

    - for typedefs in non-template classes adjust underlying       type to emit proper debug info (#601893)

  - fix up fastjar directory traversal bugs (CVE-2010-0831)

    - Tue Jun 8 2010 Jakub Jelinek <jakub at redhat.com>       4.4.4-7

    - update from gcc-4_4-branch

    - PRs c++/43555, fortran/42900, fortran/44360,       libfortran/41169, libgcj/38251, libobjc/36610,       libstdc++/32499, pch/14940, rtl-optimization/39580,       target/44075, target/44169, target/44199

  - VTA backports

    - PRs debug/44367, debug/44375, rtl-optimization/44013,       tree-optimization/44182

  - speed up var-tracking (#598310, PR debug/41371)

    - -Wunused-but-set-* bugfixes

    - PRs c++/44361, c++/44362, c++/44412, c++/44443,       c++/44444

    - fix -mno-fused-madd -mfma4 on i?86/x86_64 (PR       target/44338)

    - use GCJ_PROPERTIES=jdt.compiler.useSingleThread=true       when building classes with ecj1 (#524155)

  - Tue May 25 2010 Jakub Jelinek <jakub at redhat.com>     4.4.4-5

    - update from gcc-4_4-branch

    - PRs bootstrap/43870, debug/44205, target/43733,       target/44074, target/44202, target/44245,       tree-optimization/43845

  - fix cv-qual issue with function types (#593750, PR     c++/44193)

[plus 297 lines in the Changelog]

libtool-2.2.6-18.fc12.1 :

  - Wed Jun 30 2010 Jakub Jelinek <jakub at redhat.com>     2.2.6-18.fc12.1

    - rebuilt for gcc 4.4.4

    - Thu Jan 21 2010 Jakub Jelinek <jakub at redhat.com>       2.2.6-18

    - rebuilt for gcc 4.4.3

    - Wed Dec 2 2009 Karsten Hopp <karsten at redhat.com>       2.2.6-17

    - fix directory name used in libtool tarball

    - Wed Dec 2 2009 Karsten Hopp <karsten at redhat.com>       2.2.6-16

    - update to 2.2.6b, fixes CVE-2009-3736: libltdl may       load and execute code from a library in the current       directory

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Jun 30 2010 Jakub Jelinek <jakub at redhat.com>     4.4.4-10

    - update from gcc-4_4-branch

    - PRs fortran/43841, fortran/43843,       tree-optimization/44683

    - fix qualified-id as template argument handling       (#605761, PR c++/44587)

    - -Wunused-but-set-* static_cast fix (PR c++/44682)

    - VTA backports

    - PRs debug/44610, debug/44668, debug/44694

    - unswitching fixes (PR middle-end/43866)

    - Thu Jun 24 2010 Jakub Jelinek <jakub at redhat.com>       4.4.4-9

    - update from gcc-4_4-branch

    - PRs bootstrap/44426, bootstrap/44544, c++/44627,       fortran/44536, libgcj/44216, target/39690,       target/43740, target/44261, target/44481,       target/44534, target/44615, testsuite/32843,       testsuite/43739, tree-optimization/44508

  - VTA backports

    - PRs debug/43650, debug/44181, debug/44247

    - -Wunused-but-set-* ->*/.* fix (PR c++/44619)

    - undeprecate #ident and #sccs (#606069)

    - fixup dates in generated man pages even for fastjar       and gcc/ man pages

    - don't realign stack on x86/x86-64 just because a       DECL_ALIGN was set too high by expansion code       (#603924, PR target/44542)

  - don't allow side-effects in inline-asm memory operands     unless < or > is present in operand's constraint     (#602359, PR middle-end/44492)

  - Fri Jun 11 2010 Jakub Jelinek <jakub at redhat.com>     4.4.4-8

    - update from gcc-4_4-branch

    - fix demangler (PR other/43838)

    - VTA backports

    - further var-tracking speedup (#598310, PR debug/41371)

    - for typedefs in non-template classes adjust underlying       type to emit proper debug info (#601893)

  - fix up fastjar directory traversal bugs (CVE-2010-0831)

    - Tue Jun 8 2010 Jakub Jelinek <jakub at redhat.com>       4.4.4-7

    - update from gcc-4_4-branch

    - PRs c++/43555, fortran/42900, fortran/44360,       libfortran/41169, libgcj/38251, libobjc/36610,       libstdc++/32499, pch/14940, rtl-optimization/39580,       target/44075, target/44169, target/44199

  - VTA backports

    - PRs debug/44367, debug/44375, rtl-optimization/44013,       tree-optimization/44182

  - speed up var-tracking (#598310, PR debug/41371)

    - -Wunused-but-set-* bugfixes

    - PRs c++/44361, c++/44362, c++/44412, c++/44443,       c++/44444

    - fix -mno-fused-madd -mfma4 on i?86/x86_64 (PR       target/44338)

    - use GCJ_PROPERTIES=jdt.compiler.useSingleThread=true       when building classes with ecj1 (#524155)

  - Tue May 25 2010 Jakub Jelinek <jakub at redhat.com>     4.4.4-5

    - update from gcc-4_4-branch

    - PRs bootstrap/43870, debug/44205, target/43733,       target/44074, target/44202, target/44245,       tree-optimization/43845

  - fix cv-qual issue with function types (#593750, PR     c++/44193)

[plus 24 lines in the Changelog]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in fastjar :

Directory traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a non-initial pathname component in a filename within a .jar archive, a related issue to CVE-2005-1080. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619 (CVE-2010-0831).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

Dan Rosenberg discovered that fastjar incorrectly handled file paths containing '..' when unpacking archives. If a user or an automated system were tricked into unpacking a specially crafted jar file, arbitrary files could be overwritten with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198431	RHEL 4 : gcc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
181073	Oracle Linux 5 : gcc (ELSA-2011-0025)	Nessus	Oracle Linux Local Security Checks	critical
70780	SuSE 11.2 / 11.3 Security Update : fastjar (SAT Patch Numbers 8376 / 8377)	Nessus	SuSE Local Security Checks	medium
62363	GLSA-201209-21 : fastjar: Directory traversal	Nessus	Gentoo Local Security Checks	medium
60933	Scientific Linux Security Update : gcc on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
51523	RHEL 5 : gcc (RHSA-2011:0025)	Nessus	Red Hat Local Security Checks	medium
47612	Fedora 12 : gcc-4.4.4-10.fc12 / libtool-2.2.6-18.fc12.1 (2010-10640)	Nessus	Fedora Local Security Checks	medium
47598	Fedora 13 : gcc-4.4.4-10.fc13 (2010-10415)	Nessus	Fedora Local Security Checks	medium
47116	Mandriva Linux Security Advisory : fastjar (MDVSA-2010:122)	Nessus	Mandriva Local Security Checks	medium
47109	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : fastjar vulnerability (USN-953-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2010-0831

high

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium