REDHAT-BUG-746709: Buffer Overflow

Published Oct 17, 2011

Updated

Multiple stack-based buffer overflow flaws were found in the way hardlink, the tool for consolidation of duplicate files via hardlinks, processed directory trees with deeply nested directories. A remote attacker could provide a specially-crafted directory tree, and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable.

References: [1] http://www.openwall.com/lists/oss-security/2011/10/15/2 [2] https://bugs.gentoo.org/showbug.cgi?id=387269 [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516

Proposed patch (applied by the Owl Linux distribution): [4] http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/hardlink/hardlink.c.diff?r1=1.1;r2=1.2

Affected Software

1 affected component

Openwall hardlink

Event History

Oct 17, 2011

Data Sourced

03:32 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-746709?

The severity of REDHAT-BUG-746709 is considered critical due to the potential for remote code execution.

How do I fix REDHAT-BUG-746709?

To fix REDHAT-BUG-746709, update the Openwall hardlink tool to the latest version that addresses the buffer overflow vulnerabilities.

What software is affected by REDHAT-BUG-746709?

The affected software for REDHAT-BUG-746709 includes Openwall hardlink.

Can REDHAT-BUG-746709 be exploited remotely?

Yes, a remote attacker can exploit REDHAT-BUG-746709 through specially-crafted directory trees.

What type of vulnerability is REDHAT-BUG-746709?

REDHAT-BUG-746709 is classified as a stack-based buffer overflow vulnerability.