Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.

The remote host is affected by the vulnerability described in GLSA-201612-32 (elfutils: Heap-based buffer overflow)

    An integer overflow, in the check_section function of dwarf_begin_elf.c,       in the libdw library can lead to a heap-based buffer overflow.
  Impact :

    A remote attacker could entice a user to open a specially crafted file,       possibly resulting in the execution of arbitrary code with the privileges       of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Updated elfutils packages fix security vulnerabilities :

The libdw library provides support for accessing DWARF debugging information inside ELF files. An integer overflow flaw in check_section(), leading to a heap-based buffer overflow, was found in the libdw library. A malicious ELF file could cause an application using libdw (such as eu-readelf) to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2014-0172).

Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program (CVE-2014-9447).

Fix integer overflow in check_section (CVE-2014-0172, bnc#872785)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2188-1 advisory.

    Florian Weimer discovered that the elfutils libdw library incorrectly handled malformed compressed debug     sections in ELF files. If a user or automated system were tricked into processing a specially crafted ELF     file, applications linked against libdw could be made to crash, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix CVE-2014-0172 elfutils: integer overflow, leading to a heap-based buffer overflow in libdw. Update to 0.158. Support for aarch64.
Unwinder support for i386, x86_64, s390, s390x, ppc and ppc64. Add eu-stack.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
95735	GLSA-201612-32 : elfutils: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	medium
82357	Mandriva Linux Security Advisory : elfutils (MDVSA-2015:104)	Nessus	Mandriva Local Security Checks	medium
78288	Amazon Linux AMI : elfutils (ALAS-2014-345)	Nessus	Amazon Linux Local Security Checks	medium
77135	openSUSE Security Update : elfutils (openSUSE-SU-2014:0974-1)	Nessus	SuSE Local Security Checks	medium
73802	Ubuntu 14.04 LTS : elfutils vulnerability (USN-2188-1)	Nessus	Ubuntu Local Security Checks	high
73773	Fedora 19 : elfutils-0.158-3.fc19 (2014-5031)	Nessus	Fedora Local Security Checks	medium
73627	Fedora 20 : elfutils-0.158-3.fc20 (2014-5015)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-0172

high

Tenable Plugins

medium

medium

medium

medium

high

medium

medium