Remote Code Execution Vulnerability in unADF Package
Summary
CVE-2016-1244: The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file. Affects unadf versions < 0.7.11a-4+deb11u1. Fixed in 0.7.11a-4+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
unADF is a tool designed for extracting data from ADF (Application Data Format) files, commonly used in various applications for data storage. It allows users to manipulate and extract information from these files efficiently. However, the package has been found to be vulnerable to a remote code execution attack due to improper handling of directory names, which can lead to severe security risks.
Vulnerability Detail
The extractTree function in unADF is susceptible to remote code execution. This vulnerability arises when an attacker crafts an ADF file with malicious shell metacharacters in the directory name. When the extractTree function processes this file, it can inadvertently execute arbitrary code on the host system, leading to unauthorized access and potential data compromise. The severity of this vulnerability is underscored by its CVSS score of 8.8, indicating a high risk to affected systems.
How To Fix
Minimum fixed version
0.7.11a-4+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unadfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted ADF files that may contain malicious directory names. Additionally, implementing strict input validation on directory names can help mitigate the risk until the package is updated.
Conclusion
The unADF package has a critical vulnerability that can lead to remote code execution through malicious ADF files. Users are strongly advised to update their packages to the latest secure versions and to implement workarounds until a full resolution is achieved. Regular monitoring for vulnerabilities using tools like Vulert can enhance security.
See every vulnerability recorded for unadf →
FAQ
The vulnerability allows remote attackers to execute arbitrary code by exploiting shell metacharacters in directory names within ADF files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If immediate updates are not possible, avoid processing untrusted ADF files and implement strict input validation as a temporary workaround.
For more information on open-source vulnerabilities, you can visit Vulert at https://vulert.com, which monitors and alerts for vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for unadf.
