The fileutils package contains several basic system utilities. One of
these utilities is the “ls” program, which is used to list information
about files and directories.
Georgi Guninski discovered a memory starvation denial of service
vulnerability in the ls program. It is possible to make ls allocate a
huge amount of memory by specifying certain command line arguments. This
vulnerability is remotely exploitable through services like wu-ftpd, which
pass user arguments to ls. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2003-0854 to this issue.
A non-exploitable integer overflow in ls has been discovered. It is
possible to make ls crash by specifying certain command line arguments.
This vulnerability is remotely exploitable through services like wu-ftpd,
which pass user arguments to ls. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2003-0853 to this issue.
Users are advised to update to these erratum packages, which contain
backported security patches that correct these vulnerabilities.
These packages also add support for the O_DIRECT flag, which controls the
use of synchronous I/O on file systems such as OCFS.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | any | i386 | fileutils | < 4.1-10.4 | fileutils-4.1-10.4.i386.rpm |
RedHat | any | ia64 | fileutils | < 4.1-10.4 | fileutils-4.1-10.4.ia64.rpm |