Integer underflow in the file_printf function in the "file" program before 4.20 allows user-assisted attackers to execute arbitrary code via a file that triggers a heap-based buffer overflow.

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2007:0124 :

An updated file package that fixes a security flaw is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The file command is used to identify a particular file according to the type of data contained by the file.

An integer underflow flaw was found in the file utility. An attacker could create a carefully crafted file which, if examined by a victim using the file utility, could lead to arbitrary code execution.
(CVE-2007-1536)

This issue did not affect the version of the file utility distributed with Red Hat Enterprise Linux 2.1 or 3.

Users should upgrade to this erratum package, which contain a backported patch to correct this issue.

The fix for CVE-2007-1536 introduced a new integer underflow flaw in the file utility. An attacker could create a carefully crafted file which, if examined by a victim using the file utility, could lead to arbitrary code execution. (CVE-2007-2799)

An integer underflow within the ELF header parsing has been fixed which could lead to arbitrary code execution. CVE-2007-1536 has been assigned to this issue.

Jean-Sebastien Guay-Leroux discovered that 'file' did not correctly check the size of allocated heap memory. If a user were tricked into examining a specially crafted file with the 'file' utility, a remote attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200710-19 (The Sleuth Kit: Integer underflow)

    Jean-Sebastien Guay-Leroux reported an integer underflow in the     file_printf() function of the 'file' utility which is bundled with The     Sleuth Kit (CVE-2007-1536, GLSA 200703-26). Note that Gentoo is not     affected by the improper fix for this vulnerability (identified as     CVE-2007-2799, see GLSA 200705-25) since version 4.20 of 'file' was     never shipped with The Sleuth Kit ebuilds.
  Impact :

    A remote attacker could entice a user to run The Sleuth Kit on a file     system containing a specially crafted file that would trigger a     heap-based buffer overflow possibly leading to the execution of     arbitrary code with the rights of the user running The Sleuth Kit.
  Workaround :

    There is no known workaround at this time.

When writing data into a buffer in the file_printf function, the length of the unused portion of the buffer is not correctly tracked, resulting in a buffer overflow when processing certain files. Impact :
An attacker who can cause file(1) to be run on a maliciously constructed input can cause file(1) to crash. It may be possible for such an attacker to execute arbitrary code with the privileges of the user running file(1).

The above also applies to any other applications using the libmagic(3) library. Workaround : No workaround is available, but systems where file(1) and other libmagic(3)-using applications are never run on untrusted input are not vulnerable.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2007-005 applied. 

This update fixes security flaws in the following applications :

Alias Manager BIND CoreGraphics crontabs fetchmail file iChat mDNSResponder PPP ruby screen texinfo VPN

An integer underflow bug has been found in the file_printf function in file, a tool to determine file types based analysis of file content.
The bug could allow an attacker to execute arbitrary code by inducing a local user to examine a specially crafted file that triggers a buffer overflow.

The remote host is affected by the vulnerability described in GLSA-200703-26 (file: Integer underflow)

    Jean-Sebastien Guay-Leroux reported an integer underflow in     file_printf function.
  Impact :

    A remote attacker could entice a user to run the 'file' program on a     specially crafted file that would trigger a heap-based buffer overflow     possibly leading to the execution of arbitrary code with the rights of     the user running 'file'. Note that this vulnerability could be also     triggered through an automatic file scanner like amavisd-new.
  Workaround :

    There is no known workaround at this time.

New file packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and -current to fix a security issue. NOTE: In Slackware 11.0 and earlier, the file utility was part of the required 'bin' package, so this patch is needed even if your machine does not have a 'file' package installed (which, if you're not running Slackware -current, it probably does not).

An updated file package that fixes a security flaw is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The file command is used to identify a particular file according to the type of data contained by the file.

An integer underflow flaw was found in the file utility. An attacker could create a carefully crafted file which, if examined by a victim using the file utility, could lead to arbitrary code execution.
(CVE-2007-1536)

This issue did not affect the version of the file utility distributed with Red Hat Enterprise Linux 2.1 or 3.

Users should upgrade to this erratum package, which contain a backported patch to correct this issue.

Jean-Sebastien Guay-Leroux discovered an integer underflow in the file_printf() function in file prior to 4.20 that allows user-assisted attackers to execute arbitrary code via a file that triggers a heap-based buffer overflow.

Updated packages have been patched to address this issue.

ID	Name	Product	Family	Severity
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	critical
67463	Oracle Linux 4 : file (ELSA-2007-0124)	Nessus	Oracle Linux Local Security Checks	high
60191	Scientific Linux Security Update : file on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
29427	SuSE 10 Security Update : file (ZYPP Patch Number 3034)	Nessus	SuSE Local Security Checks	high
28035	Ubuntu 5.10 / 6.06 LTS / 6.10 : file vulnerability (USN-439-1)	Nessus	Ubuntu Local Security Checks	high
27517	GLSA-200710-19 : The Sleuth Kit: Integer underflow	Nessus	Gentoo Local Security Checks	high
27214	openSUSE 10 Security Update : file (file-3033)	Nessus	SuSE Local Security Checks	high
25359	FreeBSD : FreeBSD -- heap overflow in file(1) (8e01ab5b-0949-11dc-8163-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
25297	Mac OS X Multiple Vulnerabilities (Security Update 2007-005)	Nessus	MacOS X Local Security Checks	critical
25008	Debian DSA-1274-1 : file - buffer overflow	Nessus	Debian Local Security Checks	high
24931	GLSA-200703-26 : file: Integer underflow	Nessus	Gentoo Local Security Checks	high
24916	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 / current : file [and bin package] (SSA:2007-093-01)	Nessus	Slackware Local Security Checks	high
24897	RHEL 4 / 5 : file (RHSA-2007:0124)	Nessus	Red Hat Local Security Checks	high
24893	Mandrake Linux Security Advisory : file (MDKSA-2007:067)	Nessus	Mandriva Local Security Checks	high
24878	CentOS 4 : file (CESA-2007:0124)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2007-1536

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

critical

high

high

high

high

high

high