DISPUTED OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user account that entered the command line.
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfsistat() in fs/yaffs.c.
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfsdinodelookup in fs/ntfs.c.
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an out of bounds read on iso9660 while parsing System Use Sharing Protocol data in fs/iso9660.c.
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfsdent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfscattraverse() in lines: 952, 1062. The attack vector is: Victim must open a crafted HFS filesystem image.
In The Sleuth Kit (TSK) through 4.6.4, hfscattraverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which allows attackers to cause a denial of service (SEGV on unknown address with READ memory access in a tskgetu16 call in hfsdiropenmetacb in tsk/fs/hfsdent.c).
An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function rawread in tsk/img/raw.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.
An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfsmakedatarun in tsk/fs/ntfs.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.
An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function tskUTF16toUTF8 in tsk/base/tskunicode.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.
An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfsfixidxrec in tsk/fs/ntfsdent.cpp which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
In The Sleuth Kit (TSK) 4.4.2, fls hangs on a corrupt exfat image in tskimgread() in tsk/img/imgio.c in libtskimg.a.
In The Sleuth Kit (TSK) 4.4.2, opening a crafted disk image triggers infinite recursion in dosloadexttable() in tsk/vs/dos.c in libtskvs.a, as demonstrated by mmls.
In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660procdir() in tsk/fs/iso9660dent.c in libtskfs.a, as demonstrated by fls.
A security flaw was found in the way the Sleuth Kit (TSK), a collection of UNIX-based command line tools allowing to investigate a computer, performed management of '.' (dotfile) file system entry. An attacker could use this flaw to evade detection by forensic analysis (hide certain files not to be scanned) by renaming the file in question it to be '.' file system entry.
The original reports speaks about this attack vector to be present when scanning FAT (File Allocation Table) file system. It is possible though, the flaw to be present on other file systems, which do not reserve usage of '.' entry for special purpose, too.
References: [1] http://www.openwall.com/lists/oss-security/2012/12/01/2 [2] http://sourceforge.net/mailarchive/forum.php?threadname=1305739444.2355.35.camel%40zwerfkat&forumname=sleuthkit-users [3] http://sourceforge.net/mailarchive/forum.php?threadname=20120503111900.GL18142%40hauptmenue&forumname=sleuthkit-users [4] http://labs.bitdefender.com/2012/06/flame-the-story-of-leaked-data-carried-by-human-vector/ [5] http://blog.crysys.hu/2012/06/flame-usb-dot-file-confirmed/ [6] http://www.openwall.com/lists/oss-security/2012/12/04/2
Upstream bug report: [7] http://sourceforge.net/tracker/?func=detail&aid=3523019&groupid=55685&atid=477889
Upstream patch: OSS-security post [1] mentions no upstream patch to correct this issue to be available yet / so far.