A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

The vulnerability occurs in pointer arithmetic when parsing an unusually large key value (UINTMAXMAX) in traditional key syntax (+POS1.C1). If a user executes a crafted command like sort +0.18446744073709551615R, pointer arithmetic may wrap around and return a pointer before the start of the allocated buffer. This flaw can lead to an out-of-bounds memory read and potentially information disclosure.

Affected Versions: GNU Coreutils versions 7.2 through the current version are affected.

chroot in GNU coreutils when used with --userspec allows local users to escape to the parent session via a crafted TIOCSTI ioctl call which pushes characters to the terminal's input buffer.

fts.c in coreutils 8.4 allows local users to delete arbitrary files.

The "distcheck" Makefile rule in coreutils 5.2.1 through to 8.1 did use unsafe (predictable) temporary directory location for performing own tasks. This might allow local attacker to conduct symlink attacks under certain circumstances.

Upstream patch: --------------- http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5

Credit: ------- Jim Meyering

CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/12/08/4

The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a (1) locked or (2) expired account by entering the account name on the command line, related to improper use of the pamsucceedif.so module.