Sicherheit: Ausführen beliebiger Kommandos in GNU Coreutils

Lesezeichen hinzufügen

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--2lgBbs4PsBJDDSrSm64jS4TWxkRNfgAG7
Content-Type: multipart/mixed;
boundary="0CbenfO38TviFbtWAJFMLk6oXli1TdXDD"
From: Aaron Bauman <bman@gentoo.org>
To: gentoo-announce@lists.gentoo.org
Message-ID: <cafc0378-4455-ebc9-b929-70b490ae777c@gentoo.org>
Subject: [ GLSA 201612-22 ] Coreutils: Arbitrary code execution

--0CbenfO38TviFbtWAJFMLk6oXli1TdXDD
Content-Type: multipart/alternative;
boundary="------------530C35D3D4A3F1B1F4EB5875"

This is a multi-part message in MIME format.
--------------530C35D3D4A3F1B1F4EB5875
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201612-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Coreutils: Arbitrary code execution
Date: December 08, 2016
Bugs: #530514
ID: 201612-22

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A vulnerability in Coreutils could lead to the execution of arbitrary
code or a Denial of Service condition.

Background
==========

The GNU Core Utilities are the basic file, shell and text manipulation
utilities of the GNU operating system.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 sys-apps/coreutils < 8.23 >= 8.23

Description
===========

A memory corruption flaw in GNU Coreutils' parse_datetime function was
reported. Applications using parse_datetime(), such as touch or date,
may accepted untrusted input.

Impact
======

A remote attacker could possibly execute arbitrary code with the
privileges of the process, or cause a Denial of Service condition.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Coreutils users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/coreutils-8.23"

References
==========

[ 1 ] CVE-2014-9471
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9471

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/201612-22

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2016 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

--------------530C35D3D4A3F1B1F4EB5875
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html>
<head>

<meta http-equiv=3D"Content-Type" content=3D"text/html;
charset=3Dutf=
-8">
</head>
<body bgcolor=3D"#FFFFFF" text=3D"#000000">
<p>
<meta http-equiv=3D"Content-Type" content=3D"text/html;
charset=3Du=
tf-8">
</p>
<pre style=3D"color: rgb(0, 0, 0); font-style: normal;
font-variant-l=
igatures: normal; font-variant-caps: normal; font-weight: normal; letter-=
spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-tr=
ansform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0=
px; word-wrap: break-word; white-space: pre-wrap;">- - - - - - - - - - -
=
- - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201612-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
<a
class=3D"moz-txt-link-freet=
ext" href=3D"https://security.gentoo.org/">https://security.gentoo.org/</=
a>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Coreutils: Arbitrary code execution
Date: December 08, 2016
Bugs: #530514
ID: 201612-22

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=3D=3D=3D=3D=3D=3D=3D=3D

A vulnerability in Coreutils could lead to the execution of arbitrary
code or a Denial of Service condition.

Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

The GNU Core Utilities are the basic file, shell and text manipulation
utilities of the GNU operating system.

Affected packages
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 sys-apps/coreutils < 8.23
>=3D =
8.23=20

Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

A memory corruption flaw in GNU Coreutils' parse_datetime function was
reported. Applications using parse_datetime(), such as touch or date,
may accepted untrusted input.

Impact
=3D=3D=3D=3D=3D=3D

A remote attacker could possibly execute arbitrary code with the
privileges of the process, or cause a Denial of Service condition.

Workaround
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

There is no known workaround at this time.

Resolution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

All Coreutils users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=3Dsys-apps/coreutils-8.23"

References
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

[ 1 ] CVE-2014-9471
<a class=3D"moz-txt-link-freetext" href=3D"http://nvd.nist.gov/nvd.=
cfm?cvename=3DCVE-2014-9471">http://nvd.nist.gov/nvd.cfm?cvename=3DCVE-20=
14-9471</a>

Availability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

<a class=3D"moz-txt-link-freetext" href=3D"https://security.gentoo.org/g=
lsa/201612-22">https://security.gentoo.org/glsa/201612-22</a>

Concerns?
=3D=3D=3D=3D=3D=3D=3D=3D=3D

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
<a class=3D"moz-txt-link-abbreviated"
href=3D"mailto:security@gentoo.org"=
>security@gentoo.org</a> or alternatively, you may file a bug at
<a class=3D"moz-txt-link-freetext" href=3D"https://bugs.gentoo.org">https=
://bugs.gentoo.org</a>.

License
=3D=3D=3D=3D=3D=3D=3D

Copyright 2016 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

<a class=3D"moz-txt-link-freetext" href=3D"http://creativecommons.org/lic=
enses/by-sa/2.5">http://creativecommons.org/licenses/by-sa/2.5</a></pre>
</body>
</html>

--------------530C35D3D4A3F1B1F4EB5875--

--0CbenfO38TviFbtWAJFMLk6oXli1TdXDD--

--2lgBbs4PsBJDDSrSm64jS4TWxkRNfgAG7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQJ8BAEBCgBmBQJYSVwzXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ1OTcyRDI4NDhFOEE0NDYwRTdERTY4QUM5
RjI4QkQ4QkQxRTM5NUZGAAoJEJ8ovYvR45X/AKsP/j4cKQQmDQ5VasgUX3c5qlxa
5eC7geHURGdqUrmEliV7mEVwP5CSolYmof2aLYjDe7QNVCwRyUwK0GiYfUgtDpc0
srWQhkvWVlAIjiomDNDJSleaWJit48UH8u6a3x39oMNBjzcxKrX3LlMvsyljTkel
TemfCfvYzps5f0lo5utMKlIEZHWwP7xNsro8Vi5SK2ut/M/YdpltAtyEksCBPN6X
yAxaTfvSEwkbC3HJ/QpWE+dmji/eAuUa6HPPm6q0WlTebIBLd+Q4kYQc9ZU613D8
JXb+DxonssH6T4CQOmCUyqBYRileWx/gKGLOzJn5N2H4yO8EdETx/164S90kh1bt
8k84hcwmCh+etVtg5wZ8j4dN6VwCIn3Mya8f5ZnXNUMZIb7IW20ptBzIW3ISoJod
KgrR0VWvWvlh8ETLnNJSyYaoIJ+G0/vPcVyokRMa12NACE5EWV5XzK/eLApyk5ky
JgtQSbyO0/545+I8BaTndYoNGEGImfXMhMOkmyhqW7joQIwG3qGpED3Nh6oK0dmi
0yU3U/xcu83O2nezLunS79mJcmOZ7dvekaZMJ6dTKyqFVLU5z82jM2stO05xnZEf
p+P7nQq/m6FWvxgQES9jJXtCLDIfOUbtwI9++BmPvoH5P990sZ2/40vDEvuMRlna
HV/b5606WO+3C5th042t
=BpjA
-----END PGP SIGNATURE-----

--2lgBbs4PsBJDDSrSm64jS4TWxkRNfgAG7--