10 December 2007, 12:04
Linux distributors fix vulnerability in e2fsprogs file system tools
This is one security vulnerability which is likely to be primarily of interest to forensic investigators and data rescue services. As a result of multiple integer overflows in the libext2f Linux library, specially crafted file systems or images can be used to inject malicious code onto a computer performing an analysis and execute it with the user's privileges. According to Linux distributor Ubuntu, calling fsck is sufficient to trigger this condition. The crafted image can for example be located on a hard drive which is to be analysed. All Ext2 Filesystem Utilities (e2fsprogs) programs are affected. Both Ubuntu and Novell have already released new packages for their distributions.
- SUSE Security Summary Report SUSE-SR:2007:025, security advisory from Suse
- e2fsprogs vulnerability, security advisory from Ubuntu
(mba)
Print Version | Send by email
| Permalink: http://h-online.com/-735635
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
