Ubuntu Security Notice USN-2482-1
22nd January, 2015
elfutils vulnerability
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary
elfutils could be made to overwrite files in the root directory if it received
a specially crafted file.
Software description
- elfutils
– collection of utilities to handle ELF objects
Details
Alexander Cherepanov discovered that libelf1 incorrectly handled certain
filesystem paths while extracting ar archives. An attacker could use this flaw
to perform a directory traversal attack on the root directory if the process
extracting the ar archive has write access to the root directory.
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 14.10:
-
libelf1
0.160-0ubuntu2.1
- Ubuntu 14.04 LTS:
-
libelf1
0.158-0ubuntu5.2
- Ubuntu 12.04 LTS:
-
libelf1
0.152-1ubuntu3.1
- Ubuntu 10.04 LTS:
-
libelf1
0.143-1ubuntu0.1
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart applications using libelf1
to make all the necessary changes.