National Cyber-Alert System

Vulnerability Summary for CVE-2007-1536

Overview

Integer underflow in the file_printf function in the "file" program before 4.20 allows user-assisted attackers to execute arbitrary code via a file that triggers a heap-based buffer overflow.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#606700

Name: VU#606700

Hyperlink:http://www.kb.cert.org/vuls/id/606700

External Source: SECUNIA

Name: 24548

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/24548

External Source: MLIST

Name: [file] 20070302 file-4.20 is now available

Type: Patch Information

Hyperlink:http://mx.gw.com/pipermail/file/2007/000161.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1148

Hyperlink:https://issues.rpath.com/browse/RPL-1148

External Source: CONFIRM

Name: https://bugs.gentoo.org/show_bug.cgi?id=171452

Hyperlink:https://bugs.gentoo.org/show_bug.cgi?id=171452

External Source: UBUNTU

Name: USN-439-1

Hyperlink:http://www.ubuntu.com/usn/usn-439-1

External Source: SECTRACK

Name: 1017796

Hyperlink:http://www.securitytracker.com/id?1017796

External Source: BID

Name: 23021

Hyperlink:http://www.securityfocus.com/bid/23021

External Source: REDHAT

Name: RHSA-2007:0124

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0124.html

External Source: SUSE

Name: SUSE-SR:2007:005

Hyperlink:http://www.novell.com/linux/security/advisories/2007_5_sr.html

External Source: VUPEN

Name: ADV-2007-1040

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2007/1040

External Source: DEBIAN

Name: DSA-1274

Hyperlink:http://www.debian.org/security/2007/dsa-1274

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2007-179.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2007-179.htm

External Source: SLACKWARE

Name: SSA:2007-093-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.512926

External Source: GENTOO

Name: GLSA-200703-26

Hyperlink:http://security.gentoo.org/glsa/glsa-200703-26.xml

External Source: SECUNIA

Name: 25133

Type: Advisory

Hyperlink:http://secunia.com/advisories/25133

External Source: SECUNIA

Name: 24754

Type: Advisory

Hyperlink:http://secunia.com/advisories/24754

External Source: SECUNIA

Name: 24723

Type: Advisory

Hyperlink:http://secunia.com/advisories/24723

External Source: SECUNIA

Name: 24617

Type: Advisory

Hyperlink:http://secunia.com/advisories/24617

External Source: SECUNIA

Name: 24616

Hyperlink:http://secunia.com/advisories/24616

External Source: SECUNIA

Name: 24608

Type: Advisory

Hyperlink:http://secunia.com/advisories/24608

External Source: SECUNIA

Name: 24604

Hyperlink:http://secunia.com/advisories/24604

External Source: SECUNIA

Name: 24592

Type: Advisory

Hyperlink:http://secunia.com/advisories/24592

External Source: MANDRIVA

Name: MDKSA-2007:067

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:067

External Source: XF

Name: openbsd-file-bo(36283)

Hyperlink:http://xforce.iss.net/xforce/xfdb/36283

External Source: BUGTRAQ

Name: 20070828 Re: OpenBSD 4.1 - Heap overflow vulnerabillity

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/477950/100/0/threaded

External Source: BUGTRAQ

Name: 20070825 OpenBSD 4.1 - Heap overflow vulnerabillity

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/477861/100/0/threaded

External Source: SUSE

Name: SUSE-SA:2007:040

Hyperlink:http://www.novell.com/linux/security/advisories/2007_40_file.html

External Source: MANDRIVA

Name: MDKSA-2007:067

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:067

External Source: VUPEN

Name: ADV-2007-1939

Hyperlink:http://www.frsirt.com/english/advisories/2007/1939

External Source: GENTOO

Name: GLSA-200710-19

Hyperlink:http://security.gentoo.org/glsa/glsa-200710-19.xml

External Source: FREEBSD

Name: FreeBSD-SA-07:04

Hyperlink:http://security.freebsd.org/advisories/FreeBSD-SA-07:04.file.asc

External Source: SECUNIA

Name: 29179

Hyperlink:http://secunia.com/advisories/29179

External Source: SECUNIA

Name: 27314

Hyperlink:http://secunia.com/advisories/27314

External Source: SECUNIA

Name: 27307

Hyperlink:http://secunia.com/advisories/27307

External Source: SECUNIA

Name: 25989

Hyperlink:http://secunia.com/advisories/25989

External Source: SECUNIA

Name: 25931

Hyperlink:http://secunia.com/advisories/25931

External Source: SECUNIA

Name: 25402

Hyperlink:http://secunia.com/advisories/25402

External Source: SECUNIA

Name: 25393

Hyperlink:http://secunia.com/advisories/25393

External Source: OPENBSD

Name: [4.0] 20070709 015: SECURITY FIX: July 9, 2007

Hyperlink:http://openbsd.org/errata40.html#015_file

External Source: APPLE

Name: APPLE-SA-2007-05-24

Hyperlink:http://lists.apple.com/archives/security-announce/2007/May/msg00004.html

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=305530

Hyperlink:http://docs.info.apple.com/article.html?artnum=305530

External Source: NETBSD

Name: NetBSD-SA2008-001

Hyperlink:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-001.txt.asc