REDHAT-BUG-746710: Buffer Overflow
Multiple integer overflows, leading to heap-based buffer overflows were found in the way hardlink, the tool for consolidation of duplicate files via hardlinks performed string lengths concatenation in the calculation of the required memory space to be used. A remote attacker could provide a specially-crafted directory tree (with long directory and / or file names), and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable.
References: [1] http://www.openwall.com/lists/oss-security/2011/10/15/2 [2] https://bugs.gentoo.org/showbug.cgi?id=387269 [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516
Proposed patch (applied by the Owl Linux distribution): [4] http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/hardlink/hardlink.c.diff?r1=1.2;r2=1.3
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-746710?
REDHAT-BUG-746710 is classified as a critical vulnerability due to the potential for remote exploitation leading to heap-based buffer overflows.
How do I fix REDHAT-BUG-746710?
To address REDHAT-BUG-746710, users should update the Openwall hardlink tool to the latest patched version as recommended by the vendor.
What are the potential impacts of REDHAT-BUG-746710?
Exploiting REDHAT-BUG-746710 may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition.
Which versions of Openwall hardlink are affected by REDHAT-BUG-746710?
All versions of Openwall hardlink prior to the latest release that includes the fix for REDHAT-BUG-746710 are affected.
Who is impacted by the vulnerability REDHAT-BUG-746710?
Users and systems utilizing the vulnerable versions of Openwall hardlink are at risk from the exploits associated with REDHAT-BUG-746710.