Important: file

2017-10-0311:00:00

alas.aws.amazon.com

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

23.7%

JSON

Issue Overview:

An issue in file allowed an attacker to overwrite a fixed 20-byte stack buffer with a specially crafted .notes section in an ELF binary.

Affected Packages:

file

Issue Correction:
Run yum update file to update your system.

New Packages:

i686:  
    file-debuginfo-5.30-11.34.amzn1.i686  
    file-5.30-11.34.amzn1.i686  
    file-devel-5.30-11.34.amzn1.i686  
    file-libs-5.30-11.34.amzn1.i686  
    file-static-5.30-11.34.amzn1.i686  
  
noarch:  
    python27-magic-5.30-11.34.amzn1.noarch  
    python26-magic-5.30-11.34.amzn1.noarch  
  
src:  
    file-5.30-11.34.amzn1.src  
  
x86_64:  
    file-debuginfo-5.30-11.34.amzn1.x86_64  
    file-5.30-11.34.amzn1.x86_64  
    file-static-5.30-11.34.amzn1.x86_64  
    file-devel-5.30-11.34.amzn1.x86_64  
    file-libs-5.30-11.34.amzn1.x86_64

Additional References

Red Hat: CVE-2017-1000249

Mitre: CVE-2017-1000249

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686file-debuginfo< 5.30-11.34.amzn1file-debuginfo-5.30-11.34.amzn1.i686.rpm
Amazon Linux1i686file< 5.30-11.34.amzn1file-5.30-11.34.amzn1.i686.rpm
Amazon Linux1i686file-devel< 5.30-11.34.amzn1file-devel-5.30-11.34.amzn1.i686.rpm
Amazon Linux1i686file-libs< 5.30-11.34.amzn1file-libs-5.30-11.34.amzn1.i686.rpm
Amazon Linux1i686file-static< 5.30-11.34.amzn1file-static-5.30-11.34.amzn1.i686.rpm
Amazon Linux1noarchpython27-magic< 5.30-11.34.amzn1python27-magic-5.30-11.34.amzn1.noarch.rpm
Amazon Linux1noarchpython26-magic< 5.30-11.34.amzn1python26-magic-5.30-11.34.amzn1.noarch.rpm
Amazon Linux1x86_64file-debuginfo< 5.30-11.34.amzn1file-debuginfo-5.30-11.34.amzn1.x86_64.rpm
Amazon Linux1x86_64file< 5.30-11.34.amzn1file-5.30-11.34.amzn1.x86_64.rpm
Amazon Linux1x86_64file-static< 5.30-11.34.amzn1file-static-5.30-11.34.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	file-debuginfo	< 5.30-11.34.amzn1	file-debuginfo-5.30-11.34.amzn1.i686.rpm
Amazon Linux	1	i686	file	< 5.30-11.34.amzn1	file-5.30-11.34.amzn1.i686.rpm
Amazon Linux	1	i686	file-devel	< 5.30-11.34.amzn1	file-devel-5.30-11.34.amzn1.i686.rpm
Amazon Linux	1	i686	file-libs	< 5.30-11.34.amzn1	file-libs-5.30-11.34.amzn1.i686.rpm
Amazon Linux	1	i686	file-static	< 5.30-11.34.amzn1	file-static-5.30-11.34.amzn1.i686.rpm
Amazon Linux	1	noarch	python27-magic	< 5.30-11.34.amzn1	python27-magic-5.30-11.34.amzn1.noarch.rpm
Amazon Linux	1	noarch	python26-magic	< 5.30-11.34.amzn1	python26-magic-5.30-11.34.amzn1.noarch.rpm
Amazon Linux	1	x86_64	file-debuginfo	< 5.30-11.34.amzn1	file-debuginfo-5.30-11.34.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	file	< 5.30-11.34.amzn1	file-5.30-11.34.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	file-static	< 5.30-11.34.amzn1	file-static-5.30-11.34.amzn1.x86_64.rpm