lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.

It was found that hivex attempted to read, and possibly write, beyond its allocated buffer when reading a hive file with a very small size or with a truncated or improperly formatted content. An attacker able to supply a specially crafted hive file to an application using the hivex library could possibly use this flaw to execute arbitrary code with the privileges of the user running that application.
(CVE-2014-9273)

This update also fixes the following bug :

  - The hivex(3) man page previously contained a     typographical error. This update fixes the typo.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1378 advisory.

    [1.3.3-4.3]
    - Add missing checks for small/truncated files       resolves: rhbz#1158993
    - Fix typo in man page Win::Hivex.3.pm       resolves: rhbz#1164693

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated hivex packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Hivex is a library that can read and write Hive files, undocumented binary files that Windows uses to store the Windows Registry on disk.

It was found that hivex attempted to read, and possibly write, beyond its allocated buffer when reading a hive file with a very small size or with a truncated or improperly formatted content. An attacker able to supply a specially crafted hive file to an application using the hivex library could possibly use this flaw to execute arbitrary code with the privileges of the user running that application.
(CVE-2014-9273)

Red Hat would like to thank Mahmoud Al-Qudsi of NeoSmart Technologies for reporting this issue.

This update also fixes the following bug :

* The hivex(3) man page previously contained a typographical error.
This update fixes the typo. (BZ#1164693)

All hivex users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

This update fixes the following security issue :

  - CVE-2014-9273: Possible DOS because of missing size     checks (bnc#908614)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that hivex attempted to read beyond its allocated buffer when reading a hive file with a very small size or with a truncated or improperly formatted content. An attacker able to supply a specially crafted hive file to an application using the hivex library could possibly use this flaw to execute arbitrary code with the privileges of the user running that application. (CVE-2014-9273)

The hivex package has been upgraded to upstream version 1.3.10, which provides a number of bug fixes and enhancements over the previous version.

This update also fixes the following bugs :

  - Due to an error in the hivex_value_data_cell_offset()     function, the hivex utility could, in some cases, print     an 'Argument list is too long' message and terminate     unexpectedly when processing hive files from the Windows     Registry. This update fixes the underlying code and     hivex now processes hive files as expected.

  - A typographical error in the Win::Hivex.3pm manual page     has been corrected.

The remote host is affected by the vulnerability described in GLSA-201503-07 (hivex: User-assisted execution of arbitrary code)

    Manipulating a short or truncated hive file may trigger an out-of-bounds       read or write in hivex.
  Impact :

    A context-dependent attacker could cause an application linked against       hivex to pass a short or truncated hive file, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Updated hivex packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Hive files are undocumented binary files that Windows uses to store the Windows Registry on disk. Hivex is a library that can read and write to these files.

It was found that hivex attempted to read beyond its allocated buffer when reading a hive file with a very small size or with a truncated or improperly formatted content. An attacker able to supply a specially crafted hive file to an application using the hivex library could possibly use this flaw to execute arbitrary code with the privileges of the user running that application. (CVE-2014-9273)

Red Hat would like to thank Mahmoud Al-Qudsi of NeoSmart Technologies for reporting this issue.

The hivex package has been upgraded to upstream version 1.3.10, which provides a number of bug fixes and enhancements over the previous version. (BZ#1023978)

This update also fixes the following bugs :

* Due to an error in the hivex_value_data_cell_offset() function, the hivex utility could, in some cases, print an 'Argument list is too long' message and terminate unexpectedly when processing hive files from the Windows Registry. This update fixes the underlying code and hivex now processes hive files as expected. (BZ#1145056)

* A typographical error in the Win::Hivex.3pm manual page has been corrected. (BZ#1099286)

Users of hivex are advised to upgrade to these updated packages, which correct these issues and adds these enhancements.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-0301 advisory.

    [1.3.10-5.7]
    - Fix: 'Argument list too long' when using virt-v2v on Windows guest       with French copy of Citrix installed       related: rhbz#1145056

    [1.3.10-5.6]
    - Fix: typo in man page       resolves: rhbz#1099286

    [1.3.10-5.4]
    - Fix: hivex missing checks for small/truncated files       resolves: rhbz#1158992

    [1.3.10-5.3]
    - Fix: hivexml generates 'Argument list too long' error.
      resolves: rhbz#1145056

    [1.3.10-5.2]
    - Resolves: rhbz#1125544

    [1.3.10-5.1]
    - Rebase to hivex 1.3.10.
      resolves: rhbz#1023978

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

hivex was updated to fix a possible denial of service due to missing size checks (bnc#908614).

ID	Name	Product	Family	Severity
85195	Scientific Linux Security Update : hivex on SL6.x x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	medium
85102	Oracle Linux 6 : hivex (ELSA-2015-1378)	Nessus	Oracle Linux Local Security Checks	high
85015	CentOS 6 : hivex (CESA-2015:1378)	Nessus	CentOS Local Security Checks	medium
84941	RHEL 6 : hivex (RHSA-2015:1378)	Nessus	Red Hat Local Security Checks	medium
83684	SUSE SLES12 Security Update : hivex (SUSE-SU-2015:0320-1)	Nessus	SuSE Local Security Checks	medium
82251	Scientific Linux Security Update : hivex on SL7.x x86_64 (20150305)	Nessus	Scientific Linux Local Security Checks	medium
82006	GLSA-201503-07 : hivex: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
81886	CentOS 7 : hivex (CESA-2015:0301)	Nessus	CentOS Local Security Checks	medium
81721	Oracle Linux 7 : hivex (ELSA-2015-0301)	Nessus	Oracle Linux Local Security Checks	high
81627	RHEL 7 : hivex (RHSA-2015:0301)	Nessus	Red Hat Local Security Checks	medium
81139	openSUSE Security Update : hivex (openSUSE-SU-2015:0189-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2014-9273

high

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

high

medium

medium