USN-2482-1: elfutils vulnerability

23 January 2015

elfutils vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.10
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS
  • Ubuntu 10.04 LTS

Summary

elfutils could be made to overwrite files in the root directory if it received a specially crafted file.

Software Description

  • elfutils - collection of utilities to handle ELF objects

Details

Alexander Cherepanov discovered that libelf1 incorrectly handled certain filesystem paths while extracting ar archives. An attacker could use this flaw to perform a directory traversal attack on the root directory if the process extracting the ar archive has write access to the root directory.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.10
libelf1 - 0.160-0ubuntu2.1
Ubuntu 14.04 LTS
libelf1 - 0.158-0ubuntu5.2
Ubuntu 12.04 LTS
libelf1 - 0.152-1ubuntu3.1
Ubuntu 10.04 LTS
libelf1 - 0.143-1ubuntu0.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart applications using libelf1 to make all the necessary changes.

References