The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3762 advisory.

  - Stack-based buffer overflow in the extractTree function in unADF allows remote attackers to execute     arbitrary code via a long pathname. (CVE-2016-1243)

  - The extractTree function in unADF allows remote attackers to execute arbitrary code via shell     metacharacters in a directory name in an adf file. (CVE-2016-1244)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201804-20 (unADF: Remote code execution)

    Multiple vulnerabilities were discovered in unADF that can lead to       remote code execution. Please review the CVE identifiers referenced below       for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted       file, could execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

Tuomas Rasanen discovered two vulnerabilities in unADF, a tool to extract files from an Amiga Disk File dump (.adf) :

  - CVE-2016-1243     A stack-based buffer overflow in the function     extractTree() might allow an attacker, with control on     the content of a ADF file, to execute arbitrary code     with the privileges of the program execution.

  - CVE-2016-1244     The unADF extractor creates the path in the destination     via a mkdir in a system() call. Since there was no     sanitization on the input of the filenames, an attacker     can directly inject code in the pathnames of archived     directories in an ADF file.

ID	Name	Product	Family	Severity
192163	Debian dla-3762 : unadf - security update	Nessus	Debian Local Security Checks	critical
109234	GLSA-201804-20 : unADF: Remote code execution	Nessus	Gentoo Local Security Checks	critical
93694	Debian DSA-3676-1 : unadf - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-1244

high

Tenable Plugins

critical

critical

critical