openSUSE 15 Security Update : binutils (openSUSE-SU-2021:1475-1)

high Nessus Plugin ID 155362

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1475-1 advisory.

- A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the process_symbol_table, as demonstrated in readelf, via a crafted file. (CVE-2020-16590)

- A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process_symbol_table, as demonstrated in readeif. (CVE-2020-16591)

- A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.
(CVE-2020-16592)

- A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in scan_unit_for_symbols, as demonstrated in addr2line, that can cause a denial of service via a crafted file. (CVE-2020-16593)

- ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2020-16598)

- A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35, in _bfd_elf_get_symbol_version_string, as demonstrated in nm-new, that can cause a denial of service via a crafted file. (CVE-2020-16599)

- An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

- A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35493)

- There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34. (CVE-2020-35496)

- There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. (CVE-2020-35507)

- There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

- A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
_bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability. (CVE-2021-20284)

- A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability. (CVE-2021-20294)

- There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption. (CVE-2021-3487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 155362

File Name: openSUSE-2021-1475.nasl

Version: 1.3

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/16/2021

Updated: 11/23/2023

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-20294

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:cross-xtensa-binutils, p-cpe:/a:novell:opensuse:cross-ppc64-binutils, p-cpe:/a:novell:opensuse:cross-epiphany-binutils, p-cpe:/a:novell:opensuse:cross-aarch64-binutils, p-cpe:/a:novell:opensuse:cross-ia64-binutils, p-cpe:/a:novell:opensuse:cross-avr-binutils, p-cpe:/a:novell:opensuse:cross-riscv64-binutils, p-cpe:/a:novell:opensuse:bpftrace-tools, p-cpe:/a:novell:opensuse:libctf0, p-cpe:/a:novell:opensuse:bpftrace, p-cpe:/a:novell:opensuse:binutils-devel-32bit, p-cpe:/a:novell:opensuse:cross-rx-binutils, p-cpe:/a:novell:opensuse:cross-ppc64le-binutils, p-cpe:/a:novell:opensuse:cross-arm-binutils, p-cpe:/a:novell:opensuse:cross-s390x-binutils, p-cpe:/a:novell:opensuse:cross-hppa-binutils, p-cpe:/a:novell:opensuse:cross-ppc-binutils, p-cpe:/a:novell:opensuse:libctf-nobfd0, p-cpe:/a:novell:opensuse:cross-spu-binutils, p-cpe:/a:novell:opensuse:cross-hppa64-binutils, p-cpe:/a:novell:opensuse:cross-i386-binutils, p-cpe:/a:novell:opensuse:binutils-gold, p-cpe:/a:novell:opensuse:cross-sparc64-binutils, p-cpe:/a:novell:opensuse:cross-sparc-binutils, p-cpe:/a:novell:opensuse:cross-s390-binutils, p-cpe:/a:novell:opensuse:cross-m68k-binutils, cpe:/o:novell:opensuse:15.2, p-cpe:/a:novell:opensuse:cross-mips-binutils, p-cpe:/a:novell:opensuse:binutils-devel, p-cpe:/a:novell:opensuse:binutils

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/15/2021

Vulnerability Publication Date: 12/9/2020

Reference Information

CVE: CVE-2020-16590, CVE-2020-16591, CVE-2020-16592, CVE-2020-16593, CVE-2020-16598, CVE-2020-16599, CVE-2020-35448, CVE-2020-35493, CVE-2020-35496, CVE-2020-35507, CVE-2021-20197, CVE-2021-20284, CVE-2021-20294, CVE-2021-3487

Detections

Analytics