CVE-2014-8485: Code Injection
Last updated 24 July 2024
Other sources
Michal Zalewski reported a lack of range checking in libbfd could be used to write to an arbitrary location in memory:
http://lcamtuf.blogspot.co.uk/2014/10/psa-dont-run-strings-on-untrusted-files.html
Running "strings" on a malicious file could cause "strings" to crash or, potentially, execute arbitrary code.
Upstream bug (no patch attached yet):
https://sourceware.org/bugzilla/showbug.cgi?id=17510
References:
http://www.openwall.com/lists/oss-security/2014/10/24/10
— Red Hat
The setupgroup function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2014-8485?
CVE-2014-8485 is a vulnerability in the setup_group function in libbfd in GNU binutils 2.24 and earlier that allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.
How does CVE-2014-8485 affect the affected software?
CVE-2014-8485 affects GNU binutils versions 2.20.1-3ubuntu7.2, 2.22-6ubuntu1.2, 2.24-5ubuntu3.1, and 2.24.90.20141014-0ubuntu3.1, as well as Red Hat binutils version 2.25.
What is the severity of CVE-2014-8485?
CVE-2014-8485 has a severity level of medium.
How can I fix CVE-2014-8485?
To fix CVE-2014-8485, you should update your GNU binutils package to version 2.25 or later.
Where can I find more information about CVE-2014-8485?
You can find more information about CVE-2014-8485 in the references provided: http://www.openwall.com/lists/oss-security/2014/10/26/2, http://lcamtuf.blogspot.co.uk/2014/10/psa-dont-run-strings-on-untrusted-files.html, https://bugzilla.redhat.com/show_bug.cgi?id=1157276