jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file.

This update of jhead fixes several security problems :

  - CVE-2008-4575: buffer overflow in DoCommand()

  - CVE-2008-4639: local symlink attack

  - CVE-2008-4640: DoCommand() allowed deletion of arbitrary     files

  - CVE-2008-4641: execution of arbitrary shell commands in     DoCommand()

Security vulnerabilities have been identified and fixed in jhead.

Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service (crash) (CVE-2008-4575).

Jhead before 2.84 allows local users to overwrite arbitrary files via a symlink attack on a temporary file (CVE-2008-4639).

Jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename (CVE-2008-4640).

jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input (CVE-2008-4641).

This update provides the latest Jhead to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200901-02 (JHead: Multiple vulnerabilities)

    Marc Merlin and John Dong reported multiple vulnerabilities in JHead:
    A buffer overflow in the DoCommand() function when processing the cmd     argument and related to potential string overflows (CVE-2008-4575).
    An insecure creation of a temporary file (CVE-2008-4639).
    A error when unlinking a file (CVE-2008-4640).
    Insufficient escaping of shell metacharacters (CVE-2008-4641).
  Impact :

    A remote attacker could possibly execute arbitrary code by enticing a     user or automated system to open a file with a long filename or via     unspecified vectors. It is also possible to trick a user into deleting     or overwriting files.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
40243	openSUSE Security Update : jhead (jhead-399)	Nessus	SuSE Local Security Checks	critical
40004	openSUSE Security Update : jhead (jhead-399)	Nessus	SuSE Local Security Checks	critical
37496	Mandriva Linux Security Advisory : jhead (MDVSA-2009:041)	Nessus	Mandriva Local Security Checks	critical
35346	GLSA-200901-02 : JHead: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
35331	openSUSE 10 Security Update : jhead (jhead-5899)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2008-4639

medium

Tenable Plugins

critical

critical

critical

critical

critical