Flaw Fixed in Unix-like Systems

Apr 03, 2007

A file integer underflow vulnerability could be exploited to trigger buffer overflow in unpatched Unix-like systems.

A buffer overflow vulnerability caused by an integer underflow in the file_printf function in Unix-like operating systems has been patched.

The flaw is contained within the file program and could allow an attacker to execute arbitrary code or create a denial of service condition, according to a posting on the United States Computer Emergency Readiness Team's Web site.

File is a program used to determine what type of data is contained in a file. To trigger the overflow, a hacker would need to get a user to run a vulnerable version of file on a specially crafted file, the advisory states.

"Version 4.20 of file was released to address this issue," according to the US-CERT advisory.

If exploited, an attacker could execute malicious code with the permissions of the user running the vulnerable version of file or cause the program to crash, creating a denial-of-service condition.

Patches by Red Hat and Ubuntu were released more than a week ago for users of Red Hat Enterprise Linux 4 and 5 as well as Ubuntu 5.10, Ubuntu 6.06 LTS, Ubuntu 6.10 and corresponding versions of Kubuntu, Edubuntu, and Xubuntu. OpenWall GNU/*Linux and Mandriva have also released updates to address the issue.

In addition, running the file program with a limited user account may partially address the impact of a successful exploit of the flaw.

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: Many docs believe mobile health apps can improve patient care

add to favorites email to friend print save as pdf

Related Stories

Tailored 'activity coaching' by smartphone

2 hours ago

Today's smartphone user can obtain a lot of data about his or her health, thanks to built-in or separate sensors. Researcher Harm op den Akker of the University of Twente (CTIT Institute) now takes this health ...

Chemists tackle battery overcharge problem

2 hours ago

Research from the University of Kentucky Department of Chemistry will help batteries resist overcharging, improving the safety of electronics from cell phones to airplanes.

Operation IceBridge turns five

2 hours ago

In May 2014, two new studies concluded that a section of the land-based West Antarctic ice sheet had reached a point of inevitable collapse. Meanwhile, fresh observations from September 2014 showed sea ice ...

A newborn supernova every night

2 hours ago

Thanks to a $9 million grant from the National Science Foundation and matching funds from the Zwicky Transient Facility (ZTF) collaboration, a new camera is being built at Caltech's Palomar Observatory that ...

Recommended for you

Skin icons can tap into promise of smartwatch

1 hour ago

You have heard it before: smartwatches are cool wearables but critics remind us of the fact that their small size makes many actions cumbersome and they question how many people will really have them on their ...

Samsung phones cleared for US government use

2 hours ago

Samsung Electronics Co. said Tuesday some of its Galaxy mobile devices were approved by the National Security Agency for use with classified U.S. government networks and data, a boost to the company's efforts to expand in ...

Amazon, Simon & Schuster sign book retail deal

3 hours ago

Amazon has reached a deal with American book publisher Simon & Schuster, the companies said, though the e-commerce giant remains at loggerheads with France's Hachette over e-book pricing.

User comments : 0