Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.

This update for e2fsprogs fixes the following issues :

Security issues fixed :

  - CVE-2015-0247: Fixed couple of heap overflows in     e2fsprogs (fsck, dumpe2fs, e2image...) (bsc#915402).

  - CVE-2015-1572: Fixed potential buffer overflow in     closefs() (bsc#918346).

Bug fixes :

  - bsc#1038194: generic/405 test fails with     /dev/mapper/thin-vol is inconsistent on ext4 file     system.

  - bsc#1009532: resize2fs hangs when trying to resize a     large ext4 file system.

  - bsc#960273: xfsprogs does not call     %(?regenerate_initrd_post).

This update was imported from the SUSE:SLE-15:Update update project.

This update for e2fsprogs fixes the following issues: Security issues fixed :

  - CVE-2015-0247: Fixed couple of heap overflows in     e2fsprogs (fsck, dumpe2fs, e2image...) (bsc#915402).

  - CVE-2015-1572: Fixed potential buffer overflow in     closefs() (bsc#918346). Bug fixes :

  - bsc#1038194: generic/405 test fails with     /dev/mapper/thin-vol is inconsistent on ext4 file     system.

  - bsc#1009532: resize2fs hangs when trying to resize a     large ext4 file system.

  - bsc#960273: xfsprogs does not call     %{?regenerate_initrd_post}.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for e2fsprogs fixes the following issues :

Security issues fixed :

  - CVE-2015-0247: Fixed couple of heap overflows in     e2fsprogs (fsck, dumpe2fs, e2image...) (bsc#915402).

  - CVE-2015-1572: Fixed potential buffer overflow in     closefs() (bsc#918346).

Bug fixes :

  - bsc#1038194: generic/405 test fails with     /dev/mapper/thin-vol is inconsistent on ext4 file     system.

  - bsc#1009532: resize2fs hangs when trying to resize a     large ext4 file system.

  - bsc#960273: xfsprogs does not call     %{?regenerate_initrd_post}.

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the e2fsprogs packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The e2fsprogs package contains a number of utilities     for creating, checking, modifying, and correcting any     inconsistencies in second, third and fourth extended     (ext2/ext3/ext4) filesystems. E2fsprogs contains e2fsck     (used to repair filesystem inconsistencies after an     unclean shutdown), mke2fs (used to initialize a     partition to contain an empty ext2 filesystem), debugfs     (used to examine the internal structure of a     filesystem, to manually repair a corrupted filesystem,     or to create test cases for e2fsck), tune2fs (used to     modify filesystem parameters), and most of the other     core ext2fs filesystem utilities.

  - You should install the e2fsprogs package if you need to     manage the performance of an ext2, ext3, or ext4     filesystem.

  - Security Fix(es)

  - Heap-based buffer overflow in closefs.c in the     libext2fs library in e2fsprogs before 1.42.12 allows     local users to execute arbitrary code by causing a     crafted block group descriptor to be marked as dirty.
    NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-0247.(CVE-2015-1572)

  - Heap-based buffer overflow in openfs.c in the libext2fs     library in e2fsprogs before 1.42.12 allows local users     to execute arbitrary code via crafted block group     descriptor data in a filesystem image.(CVE-2015-0247)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-06 (e2fsprogs: Heap-based buffer overflow)

    A heap-based buffer overflow was discovered in openfs.c in the libext2fs       library in e2fsprogs.
  Impact :

    A remote attacker could entice a user to use ext2fs library (for       example, fsck) on a specially crafted Ext2/3/4 file system possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Two security issues were fixed in e2fsprogs :

CVE-2015-0247: Various heap overflows were fixed in e2fsprogs (fsck, dumpe2fs, e2image).

CVE-2015-1572: Fixed a potential buffer overflow in closefs().
(bsc#918346)

Additionally, badblocks was enhanced to work with very large partitions. (bsc#932539)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two security issues were fixed in e2fsprogs :

Security issues fixed :

  - CVE-2015-0247: Various heap overflows were fixed in     e2fsprogs (fsck, dumpe2fs, e2image...).

  - CVE-2015-1572: Fixed a potential buffer overflow in     closefs() (bsc#918346 )

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update provides the following security-fixes for e2fsprogs :

libext2fs: fix potential buffer overflow in closefs() (bsc#918346, CVE-2015-1572) libext2fs: avoid buffer overflow if s_first_meta_bg is too big (bsc#915402, CVE-2015-0247)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-based buffer overflow flaw was found in e2fsprogs. A specially crafted Ext2/3/4 file system could cause an application using the ext2fs library (for example, fsck) to crash or, possibly, execute arbitrary code.

e2fsprogs was updated to fix two security issues.

The following vulnerabilities were fixed :

  - CVE-2015-1572: A local user could have executed     arbitrary code by causing a crafted block group     descriptor to be marked as dirty. Completes fix for     CVE-2015-0247. (boo#918346)

  - CVE-2015-0247: A local user could have executed     arbitrary code via crafted block group descriptor data     in a filesystem image. (boo#915402)

Updated e2fsprogs packages fix security vulnerabilities :

The libext2fs library, part of e2fsprogs and utilized by its utilities, is affected by a boundary check error on block group descriptor information, leading to a heap based buffer overflow. A specially crafted filesystem image can be used to trigger the vulnerability (CVE-2015-0247).

The libext2fs library, part of e2fsprogs and utilized by its utilities, is affected by a boundary check error on block group descriptor information, leading to a heap based buffer overflow. A specially crafted filesystem image can be used to trigger the vulnerability. This is due to an incomplete fix for CVE-2015-0247 (CVE-2015-1572).

A broken (or maliciously crafted) file system could trigger a buffer overflow in e2fsprogs.

This update has been prepared by Nguyen Cong.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix potential buffer overflow in closefs (#1193947,     CVE-2015-1572)

    - Fix dumpe2fs segfault with no arguments (#1194063)

    - Don't require fsck prior to resize2fs -P (#1170803)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix potential buffer overflow in closefs (#1193947,     CVE-2015-1572)

    - Fix dumpe2fs segfault with no arguments (#1194063)

    - Don't require fsck prior to resize2fs -P (#1170803)       Changes e2fsck.conf so that for filesystems with       time-based check intervals set in the superblock,       these time-based checks will work again. You may need       to wait through an e2fsck on your next reboot in this       case.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jose Duart discovered that e2fsprogs incorrectly handled invalid block group descriptor data. A local attacker could use this issue with a crafted filesystem image to possibly execute arbitrary code.
(CVE-2015-0247, CVE-2015-1572).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Theodore Ts'o reports :

If s_first_meta_bg is greater than the of number block group descriptor blocks, then reading or writing the block group descriptors will end up overruning the memory buffer allocated for the descriptors.

The finding is credited to a vulnerability report from Jose Duart of Google Security Team <jduart AT google.com> and was reported through oCERT-2015-002.

Jose Duart of the Google Security Team discovered a buffer overflow in e2fsprogs, a set of utilities for the ext2, ext3, and ext4 file systems. This issue can possibly lead to arbitrary code execution if a malicious device is plugged in, the system is configured to automatically mount it, and the mounting process chooses to run fsck on the device's malicious filesystem.

  - CVE-2015-0247     Buffer overflow in the ext2/ext3/ext4 file system     open/close routines.

  - CVE-2015-1572     Incomplete fix for CVE-2015-0247.

Changes e2fsck.conf so that for filesystems with time-based check intervals set in the superblock, these time-based checks will work again. You may need to wait through an e2fsck on your next reboot in this case. New upstream release Security fix for CVE-2015-0247

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated e2fsprogs packages fix security vulnerability :

The libext2fs library, part of e2fsprogs and utilized by its utilities, is affected by a boundary check error on block group descriptor information, leading to a heap based buffer overflow. A specially crafted filesystem image can be used to trigger the vulnerability (CVE-2015-0247).

New upstream release Security fix for CVE-2015-0247

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
123227	openSUSE Security Update : e2fsprogs (openSUSE-2019-538)	Nessus	SuSE Local Security Checks	medium
120051	SUSE SLED15 / SLES15 Security Update : e2fsprogs (SUSE-SU-2018:1987-1)	Nessus	SuSE Local Security Checks	medium
111423	openSUSE Security Update : e2fsprogs (openSUSE-2018-771)	Nessus	SuSE Local Security Checks	medium
99801	EulerOS 2.0 SP1 : e2fsprogs (EulerOS-SA-2016-1038)	Nessus	Huawei Local Security Checks	medium
96237	GLSA-201701-06 : e2fsprogs: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	medium
85375	SUSE SLED11 / SLES11 Security Update : e2fsprogs (SUSE-SU-2015:1364-1)	Nessus	SuSE Local Security Checks	medium
85239	SUSE SLED12 / SLES12 Security Update : e2fsprogs (SUSE-SU-2015:1341-1)	Nessus	SuSE Local Security Checks	medium
84395	SUSE SLED11 / SLES11 Security Update : e2fsprogs (SUSE-SU-2015:1103-1)	Nessus	SuSE Local Security Checks	medium
84243	Amazon Linux AMI : e2fsprogs (ALAS-2015-542)	Nessus	Amazon Linux Local Security Checks	medium
84013	openSUSE Security Update : e2fsprogs (openSUSE-2015-400)	Nessus	SuSE Local Security Checks	medium
82320	Mandriva Linux Security Advisory : e2fsprogs (MDVSA-2015:067)	Nessus	Mandriva Local Security Checks	medium
82136	Debian DLA-153-1 : e2fsprogs security update	Nessus	Debian Local Security Checks	medium
81614	Fedora 20 : e2fsprogs-1.42.12-3.fc20 (2015-2516)	Nessus	Fedora Local Security Checks	medium
81613	Fedora 21 : e2fsprogs-1.42.12-3.fc21 (2015-2511)	Nessus	Fedora Local Security Checks	medium
81482	Ubuntu 14.04 LTS : e2fsprogs vulnerabilities (USN-2507-1)	Nessus	Ubuntu Local Security Checks	critical
81460	FreeBSD : e2fsprogs -- buffer overflow if s_first_meta_bg too big (0f488b7b-bbb9-11e4-903c-080027ef73ec)	Nessus	FreeBSD Local Security Checks	medium
81446	Debian DSA-3166-1 : e2fsprogs - security update	Nessus	Debian Local Security Checks	medium
81430	Fedora 20 : e2fsprogs-1.42.12-2.fc20 (2015-2279)	Nessus	Fedora Local Security Checks	medium
81334	Mandriva Linux Security Advisory : e2fsprogs (MDVSA-2015:045)	Nessus	Mandriva Local Security Checks	medium
81324	Amazon Linux AMI : e2fsprogs (ALAS-2015-478)	Nessus	Amazon Linux Local Security Checks	medium
81221	Fedora 21 : e2fsprogs-1.42.12-1.fc21 (2015-1840)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2015-0247

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium