The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.

This update of jhead fixes several security problems :

  - CVE-2008-4575: buffer overflow in DoCommand()

  - CVE-2008-4639: local symlink attack

  - CVE-2008-4640: DoCommand() allowed deletion of arbitrary     files

  - CVE-2008-4641: execution of arbitrary shell commands in     DoCommand()

Security vulnerabilities have been identified and fixed in jhead.

Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service (crash) (CVE-2008-4575).

Jhead before 2.84 allows local users to overwrite arbitrary files via a symlink attack on a temporary file (CVE-2008-4639).

Jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename (CVE-2008-4640).

jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input (CVE-2008-4641).

This update provides the latest Jhead to correct these issues.

- fixes 'CVE-2008-4640 jhead: arbitrary file deletion'     (#468056) * fixes 'CVE-2008-4641 jhead: command exection     caused by incorrect handling of the shell escapes'     (#468057)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200901-02 (JHead: Multiple vulnerabilities)

    Marc Merlin and John Dong reported multiple vulnerabilities in JHead:
    A buffer overflow in the DoCommand() function when processing the cmd     argument and related to potential string overflows (CVE-2008-4575).
    An insecure creation of a temporary file (CVE-2008-4639).
    A error when unlinking a file (CVE-2008-4640).
    Insufficient escaping of shell metacharacters (CVE-2008-4641).
  Impact :

    A remote attacker could possibly execute arbitrary code by enticing a     user or automated system to open a file with a long filename or via     unspecified vectors. It is also possible to trick a user into deleting     or overwriting files.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
40243	openSUSE Security Update : jhead (jhead-399)	Nessus	SuSE Local Security Checks	critical
40004	openSUSE Security Update : jhead (jhead-399)	Nessus	SuSE Local Security Checks	critical
37496	Mandriva Linux Security Advisory : jhead (MDVSA-2009:041)	Nessus	Mandriva Local Security Checks	critical
36735	Fedora 10 : jhead-2.86-1.fc10 (2009-1824)	Nessus	Fedora Local Security Checks	critical
35781	Fedora 9 : jhead-2.86-1.fc9 (2009-1776)	Nessus	Fedora Local Security Checks	critical
35346	GLSA-200901-02 : JHead: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
35331	openSUSE 10 Security Update : jhead (jhead-5899)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2008-4641

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical