Gentoo: file Buffer overflow vulnerability
Posted by LinuxSecurity.com Team   
Gentoo The file(1) command contains a buffer overflow vulnerability that canbe leveraged by an attacker to execute arbitrary code under theprivileges of another user.

- ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200303-8
- ---------------------------------------------------------------------

          PACKAGE : file
          SUMMARY : buffer overflow
             DATE : 2003-03-08 22:11 UTC
          EXPLOIT : local
VERSIONS AFFECTED : <3.41
    FIXED VERSION : =>3.41
              CVE : CAN-2003-0102

- ---------------------------------------------------------------------

>From advisory:
"The file(1) command contains a buffer overflow vulnerability that can
be leveraged by an attacker to execute arbitrary code under the
privileges of another user."

Read the full advisory at: 
http://www.idefense.com/advisory/03.04.03.txt

SOLUTION

It is recommended that all Gentoo Linux users who are running
sys-apps/file upgrade to file-3.41 as follows:

emerge sync
emerge file
emerge clean

- ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at  http://cvs.gentoo.org/~aliz
- ---------------------------------------------------------------------