1. Ubuntu Security Notices
  2. USN-2482-1

USN-2482-1: elfutils vulnerability

Publication date

23 January 2015

Overview

elfutils could be made to overwrite files in the root directory if it received a specially crafted file.

Releases

Packages

  • elfutils - collection of utilities to handle ELF objects

Details

Alexander Cherepanov discovered that libelf1 incorrectly handled certain
filesystem paths while extracting ar archives. An attacker could use this flaw
to perform a directory traversal attack on the root directory if the process
extracting the ar archive has write access to the root directory.

Alexander Cherepanov discovered that libelf1 incorrectly handled certain
filesystem paths while extracting ar archives. An attacker could use this flaw
to perform a directory traversal attack on the root directory if the process
extracting the ar archive has write access to the root directory.

Update instructions

After a standard system update you need to restart applications using libelf1 to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
14.10 utopic libelf1 –  0.160-0ubuntu2.1
14.04 trusty libelf1 –  0.158-0ubuntu5.2
12.04 precise libelf1 –  0.152-1ubuntu3.1
10.04 lucid libelf1 –  0.143-1ubuntu0.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›