Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the "addition of CHUNK_HEADER_SIZE to the length," which triggers a heap-based buffer overflow.

This update fixes several issues as described below.

PR ld/12613 (no CVE assigned)

Niranjan Hasabnis discovered that passing an malformed linker script to GNU ld, part of binutils, may result in a stack-based buffer overflow. If the linker is used with untrusted object files, this would allow remote attackers to cause a denial of service (crash) or possibly privilege escalation.

CVE-2012-3509 #688951

Sang Kil Cha discovered that a buffer size calculation in libiberty, part of binutils, may result in integer overflow and then a heap buffer overflow. If libiberty or the commands in binutils are used to read untrusted binaries, this would allow remote attackers to cause a denial of service (crash) or possibly privilege escalation.

PR binutils/18750 (no CVE assigned)

Joshua Rogers reported that passing a malformed ihex (Intel hexadecimal) file to to various commands in binutils may result in a stack-based buffer overflow. A similar issue was found in readelf. If these commands are used to read untrusted binaries, this would allow remote attackers to cause a denial of service (crash) or possibly privilege escalation.

For the oldoldstable distribution (squeeze), these problems have been fixed in version 2.20.1-16+deb6u2.

For the oldstable distribution (wheezy) and the stable distribution (jessie), PR ld/12613 and CVE-2012-3509 were fixed before release, and PR binutils/18750 will be fixed in a later update.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2496-1 advisory.

    Michal Zalewski discovered that the setup_group function in libbfd in GNU binutils did not properly check     group headers in ELF files. An attacker could use this to craft input that could cause a denial of service     (application crash) or possibly execute arbitrary code. (CVE-2014-8485)

    Hanno Bck discovered that the _bfd_XXi_swap_aouthdr_in function in libbfd in GNU binutils allowed out-     of-bounds writes. An attacker could use this to craft input that could cause a denial of service     (application crash) or possibly execute arbitrary code. (CVE-2014-8501)

    Hanno Bck discovered a heap-based buffer overflow in the pe_print_edata function in libbfd in GNU     binutils. An attacker could use this to craft input that could cause a denial of service (application     crash) or possibly execute arbitrary code. (CVE-2014-8502)

    Alexander Cherepanov discovered multiple directory traversal vulnerabilities in GNU binutils. An attacker     could use this to craft input that could delete arbitrary files. (CVE-2014-8737)

    Alexander Cherepanov discovered the _bfd_slurp_extended_name_table function in libbfd in GNU binutils     allowed invalid writes when handling extended name tables in an archive. An attacker could use this to     craft input that could cause a denial of service (application crash) or possibly execute arbitrary code.
    (CVE-2014-8738)

    Hanno Bck discovered a stack-based buffer overflow in the ihex_scan function in libbfd in GNU binutils.
    An attacker could use this to craft input that could cause a denial of service (application crash).
    (CVE-2014-8503)

    Michal Zalewski discovered a stack-based buffer overflow in the srec_scan function in libbfd in GNU     binutils. An attacker could use this to to craft input that could cause a denial of service (application     crash); the GNU C library's Fortify Source printf protection should prevent the possibility of executing     arbitrary code. (CVE-2014-8504)

    Michal Zalewski discovered that the srec_scan function in libbfd in GNU binutils allowed out-of-bounds     reads. An attacker could use this to craft input to cause a denial of service. This issue only affected     Ubuntu 14.04 LTS, Ubuntu 12.04 LTS, and Ubuntu 10.04 LTS. (CVE-2014-8484)

    Sang Kil Cha discovered multiple integer overflows in the _objalloc_alloc function and objalloc_alloc     macro in binutils. This could allow an attacker to cause a denial of service (application crash). This     issue only affected Ubuntu 12.04 LTS and Ubuntu 10.04 LTS. (CVE-2012-3509)

    Alexander Cherepanov and Hanno Bck discovered multiple additional out-of-bounds reads and writes in GNU     binutils. An attacker could use these to craft input that could cause a denial of service (application     crash) or possibly execute arbitrary code. A few of these issues may be limited in exposure to a denial of     service (application abort) by the GNU C library's Fortify Source printf protection.

    The strings(1) utility in GNU binutils used libbfd by default when examining executable object files;
    unfortunately, libbfd was not originally developed with the expectation of hostile input. As a defensive     measure, the behavior of strings has been changed to default to 'strings --all' behavior, which does not     use libbfd; use the new argument to strings, '--data', to recreate the old behavior.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in binutils :

Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the addition of CHUNK_HEADER_SIZE to the length, which triggers a heap-based buffer overflow (CVE-2012-3509).

The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record (CVE-2014-8484).

The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file (CVE-2014-8485).

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable (CVE-2014-8501).

Heap-based buffer overflow in the pe_print_edata function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a truncated export table in a PE file (CVE-2014-8502).

Stack-based buffer overflow in the ihex_scan function in bfd/ihex.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted ihex file (CVE-2014-8503).

Stack-based buffer overflow in the srec_scan function in bfd/srec.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a crafted file (CVE-2014-8504).

Multiple directory traversal vulnerabilities in GNU binutils 2.24 and earlier allow local users to delete arbitrary files via a .. (dot dot) or full path name in an archive to (1) strip or (2) objcopy or create arbitrary files via (3) a .. (dot dot) or full path name in an archive to ar (CVE-2014-8737).

The _bfd_slurp_extended_name_table function in bfd/archive.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (invalid write, segmentation fault, and crash) via a crafted extended name table in an archive (CVE-2014-8738).

The updated packages provides a solution for these security issues.

Security patch for libiberty

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Nov 15 2012 Patrick Monnerat <pm at datasphere.ch>     7.4.50-4.20120403cvs

    - Path 'objalloc' to fix libiberty security bug       CVE-2012-3509.
      https://bugzilla.redhat.com/show_bug.cgi?id=877014

  - Enable Python to support STL extensions.
    https://bugzilla.redhat.com/show_bug.cgi?id=865554

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
86227	Debian DLA-324-1 : binutils security update	Nessus	Debian Local Security Checks	medium
81255	Ubuntu 14.04 LTS : GNU binutils vulnerabilities (USN-2496-1)	Nessus	Ubuntu Local Security Checks	high
81195	Mandriva Linux Security Advisory : binutils (MDVSA-2015:029-1)	Nessus	Mandriva Local Security Checks	high
76979	Fedora 19 : sdcc-3.3.0-1.fc19 (2014-8528)	Nessus	Fedora Local Security Checks	medium
76978	Fedora 20 : sdcc-3.3.0-1.fc20 (2014-8510)	Nessus	Fedora Local Security Checks	medium
63042	Fedora 18 : insight-7.4.50-4.20120403cvs.fc18 (2012-18360)	Nessus	Fedora Local Security Checks	medium
63041	Fedora 17 : insight-7.4.50-4.20120403cvs.fc17 (2012-18311)	Nessus	Fedora Local Security Checks	medium
63040	Fedora 16 : insight-7.4.50-4.20120403cvs.fc16 (2012-18300)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-3509

high

Tenable Plugins

medium

high

high

medium

medium

medium

medium

medium