Flaw Fixed in Unix-like Systems

Apr 03, 2007

A file integer underflow vulnerability could be exploited to trigger buffer overflow in unpatched Unix-like systems.

A buffer overflow vulnerability caused by an integer underflow in the file_printf function in Unix-like operating systems has been patched.

The flaw is contained within the file program and could allow an attacker to execute arbitrary code or create a denial of service condition, according to a posting on the United States Computer Emergency Readiness Team's Web site.

File is a program used to determine what type of data is contained in a file. To trigger the overflow, a hacker would need to get a user to run a vulnerable version of file on a specially crafted file, the advisory states.

"Version 4.20 of file was released to address this issue," according to the US-CERT advisory.

If exploited, an attacker could execute malicious code with the permissions of the user running the vulnerable version of file or cause the program to crash, creating a denial-of-service condition.

Patches by Red Hat and Ubuntu were released more than a week ago for users of Red Hat Enterprise Linux 4 and 5 as well as Ubuntu 5.10, Ubuntu 6.06 LTS, Ubuntu 6.10 and corresponding versions of Kubuntu, Edubuntu, and Xubuntu. OpenWall GNU/*Linux and Mandriva have also released updates to address the issue.

In addition, running the file program with a limited user account may partially address the impact of a successful exploit of the flaw.

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: BPG image format judged awesome versus JPEG

add to favorites email to friend print save as pdf

Related Stories

Turning deadly chemical agents into harmless soil

35 minutes ago

Destroying chemical warfare agents in bulk is a challenge for the military and international community. Current methods of eradication, such as incineration or hydrolysis, create toxic waste that requires ...

The technological path to Mars

45 minutes ago

Can the just-flown Orion spacecraft truly get us to Mars? NASA has been portraying the mission as part of the roadmap to the Red Planet, but there are observers who say a human landing mission is an unrealistic ...

Social networks' hidden resources

45 minutes ago

People's social networks can be quite extensive, often bigger than they realize. So Brooke Foucault Welles, an assistant professor of communication studies in the College of Arts, Media and Design, says it's ...

Recommended for you

BPG image format judged awesome versus JPEG

16 hours ago

If these three letters could talk, BPG, they would say something like "Farewell, JPEG." Better Portable Graphics (BPG) is a new image format based on HEVC and supported by browsers with a small Javascript ...

Atari's 'E.T.' game joins Smithsonian collection

Dec 15, 2014

One of the "E.T." Atari game cartridges unearthed this year from a heap of garbage buried deep in the New Mexico desert has been added to the video game history collection at the Smithsonian.

People finding their 'waze' to once-hidden streets

Dec 14, 2014

When the people whose houses hug the narrow warren of streets paralleling the busiest urban freeway in America began to see bumper-to-bumper traffic crawling by their homes a year or so ago, they were baffled.

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.