Vulnerability in unadf - security update
Summary
DLA-631-1: unadf - security update. Affects unadf versions < 0.7.11a-3+deb7u1. Fixed in 0.7.11a-3+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
unadf is a tool used to extract files from an Amiga Disk File dump (.adf). It is commonly used in Debian 7 Wheezy. However, it has been discovered that unadf is vulnerable to two security issues.
Vulnerability Detail
The first vulnerability, identified as CVE-2016-1243, is a stack buffer overflow caused by blindly trusting the pathname lengths of archived files. This vulnerability occurs in the extracTree() function, where a stack-allocated buffer called sysbuf is filled with sprintf() without any bounds checking. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
The second vulnerability, known as CVE-2016-1244, involves the execution of unsanitized input. The shell command used for creating directory paths is constructed by concatenating names of archived files to the end of the command string. This allows an attacker to inject malicious commands and potentially execute arbitrary code.
How To Fix
Minimum fixed version
0.7.11a-3+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade unadfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, unadf is vulnerable to two security issues that can be exploited to execute arbitrary code or cause a denial of service. To mitigate these vulnerabilities, it is crucial to upgrade the unadf package to version 0.7.11a-3+deb7u1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for unadf →
FAQ
unadf is a tool used to extract files from Amiga Disk File dumps (.adf). It is commonly used in Debian 7 Wheezy.
CVE-2016-1243 is a stack buffer overflow vulnerability in unadf. It can be exploited by an attacker to execute arbitrary code or cause a denial of service.
CVE-2016-1244 is a vulnerability in unadf that allows the execution of unsanitized input. An attacker can inject malicious commands and potentially execute arbitrary code.
To fix these vulnerabilities, you need to upgrade the unadf package to version 0.7.11a-3+deb7u1 or later.
There is no known workaround for these vulnerabilities. It is recommended to upgrade the unadf package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for unadf.
