Flaw Fixed in Unix-like Systems

Apr 03, 2007

A file integer underflow vulnerability could be exploited to trigger buffer overflow in unpatched Unix-like systems.

A buffer overflow vulnerability caused by an integer underflow in the file_printf function in Unix-like operating systems has been patched.

The flaw is contained within the file program and could allow an attacker to execute arbitrary code or create a denial of service condition, according to a posting on the United States Computer Emergency Readiness Team's Web site.

File is a program used to determine what type of data is contained in a file. To trigger the overflow, a hacker would need to get a user to run a vulnerable version of file on a specially crafted file, the advisory states.

"Version 4.20 of file was released to address this issue," according to the US-CERT advisory.

If exploited, an attacker could execute malicious code with the permissions of the user running the vulnerable version of file or cause the program to crash, creating a denial-of-service condition.

Patches by Red Hat and Ubuntu were released more than a week ago for users of Red Hat Enterprise Linux 4 and 5 as well as Ubuntu 5.10, Ubuntu 6.06 LTS, Ubuntu 6.10 and corresponding versions of Kubuntu, Edubuntu, and Xubuntu. OpenWall GNU/*Linux and Mandriva have also released updates to address the issue.

In addition, running the file program with a limited user account may partially address the impact of a successful exploit of the flaw.

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: Encryption made easier: Just talk like a parent

Related Stories

Research shows 'mulch fungus' causes turfgrass disease

1 hour ago

Inadvertently continuing a line of study they conducted about 15 years ago, a team of Penn State researchers recently discovered the causal agent for an emerging turfgrass disease affecting golf courses around ...

Study on pesticides in lab rat feed causes a stir

2 hours ago

French scientists published evidence Thursday of pesticide contamination of lab rat feed which they said discredited historic toxicity studies, though commentators questioned the analysis.

Experiments open window on landscape formation

3 hours ago

University of Oregon geologists have seen ridges and valleys form in real time and—even though the work was a fast-forwarded operation done in a laboratory setting—they now have an idea of how climate ...

To conduct, or to insulate? That is the question

3 hours ago

A new study has discovered mysterious behaviour of a material that acts like an insulator in certain measurements, but simultaneously acts like a conductor in others. In an insulator, electrons are largely stuck in one place, ...

Recommended for you

Solar Impulse 2 pilot becomes aviation legend

9 hours ago

At 62 years of age, Swiss Solar Impulse 2 pilot Andre Borschberg has made aviation history with a record breaking solo flight across the Pacific that he has called "an interior journey".

Facegloria: Facebook for Brazil's Evangelicals

9 hours ago

Fluffy clouds waft across a blue sky as you log in and while you chat with friends, Gospel music rings out: welcome to Facegloria, the social network for Brazilian Evangelicals.

Mexico City proposes regulations for Uber

9 hours ago

Mexico City is proposing regulations that would allow Uber and other smartphone-based ride-sharing apps to operate, while requiring drivers and cars to be registered, the city's Office of Legal and Legislative Studies said ...

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.