vapier 14/12/31 08:25:56 Added: elfutils-0.161-libelf-dir-traversal.patch Log: Version bump and libelf directory traversal fix from upstream #534000 by Agostino Sarubbo. (Portage version: 2.2.15/cvs/Linux x86_64, signed Manifest commit with key D2E96200)
Revision Changes Path 1.1 dev-libs/elfutils/files/elfutils-0.161-libelf-dir-traversal.patch file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-libs/elfutils/files/elfutils-0.161-libelf-dir-traversal.patch?rev=1.1&view=markup plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/dev-libs/elfutils/files/elfutils-0.161-libelf-dir-traversal.patch?rev=1.1&content-type=text/plain Index: elfutils-0.161-libelf-dir-traversal.patch =================================================================== https://bugs.gentoo.org/534000 >From 147018e729e7c22eeabf15b82d26e4bf68a0d18e Mon Sep 17 00:00:00 2001 From: Alexander Cherepanov <[email protected]> Date: Sun, 28 Dec 2014 19:57:19 +0300 Subject: [PATCH] libelf: Fix dir traversal vuln in ar extraction. read_long_names terminates names at the first '/' found but then skips one character without checking (it's supposed to be '\n'). Hence the next name could start with any character including '/'. This leads to a directory traversal vulnerability at the time the contents of the archive is extracted. The danger is mitigated by the fact that only one '/' is possible in a resulting filename and only in the leading position. Hence only files in the root directory can be written via this vuln and only when ar is executed as root. The fix for the vuln is to not skip any characters while looking for '/'. Signed-off-by: Alexander Cherepanov <[email protected]> --- libelf/ChangeLog | 5 +++++ libelf/elf_begin.c | 5 +---- 2 files changed, 6 insertions(+), 4 deletions(-) 2014-12-28 Alexander Cherepanov <[email protected]> * elf_begin.c (read_long_names): Don't miss '/' right after another '/'. Fixes a dir traversal vuln in ar extraction. diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c index 30abe0b..cd3756c 100644 --- a/libelf/elf_begin.c +++ b/libelf/elf_begin.c @@ -749,10 +749,7 @@ read_long_names (Elf *elf) } /* NUL-terminate the string. */ - *runp = '\0'; - - /* Skip the NUL byte and the \012. */ - runp += 2; + *runp++ = '\0'; /* A sanity check. Somebody might have generated invalid archive. */ -- 2.2.1
