Remote Code Execution Flaw Impacts E2fsprogs Filesystem Utility

guest · Jan 10, 2020

Remote Code Execution Flaw Impacts E2fsprogs Filesystem Utility
January 10, 2020
https://www.securityweek.com/remote-code-execution-flaw-impacts-e2fsprogs-filesystem-utility

E2fsprogs is a set of utilities designed for interaction with ext2, ext3 and ext4 filesystems. Considered essential for Linux and Unix-like operating systems, the software ships by default on most Linux distributions.

One of E2fsprogs’ components is the e2fsck binary, which aims to fix corrupted filesystems, and which Cisco Talos found to contain the out-of-bounds write flaw.
On 64-bit systems, exploitation is very unlikely, because the stack is not big enough and a user-controlled method for expanding the stack is required, the researchers explain.

Tracked as CVE-2019-5188 and featuring a CVSS score of 7.5, the vulnerability was disclosed to the vendor on December 18, 2019, and acknowledged on December 20. Versions 1.43.3 - 1.45.3 of E2fsprogs were found affected by this vulnerability. An update that patches the flaw was released this week.
Click to expand...

Cisco Talos: Vulnerability Spotlight: Remote code execution vulnerability in E2fsprogs

Log in or Sign up

Remote Code Execution Flaw Impacts E2fsprogs Filesystem Utility

guest Guest

Log in or Sign up

Remote Code Execution Flaw Impacts E2fsprogs Filesystem Utility

guest Guest

Useful Searches