| Summary: | upx new security issue CVE-2024-3209 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Nicolas Salguero <nicolas.salguero> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | andrewsfarm, sysadmin-bugs, tarazed25 |
| Version: | 9 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA9-64-OK | ||
| Source RPM: | upx-4.0.2-1.mga9.src.rpm | CVE: | CVE-2024-3209 |
| Status comment: | fixed in 4.2.3 already in Cauldron, so only for Mageia 9 | ||
|
Description
Nicolas Salguero
2024-04-09 10:16:39 CEST
Nicolas Salguero
2024-04-09 10:17:03 CEST
Source RPM:
(none) =>
upx-4.0.2-1.mga9.src.rpm Assigning to you, David; you already put version 4.2.3 in Cauldron, and have been the main committer of this pkg. Assignee:
bugsquad =>
geiger.david68210 Assigning to QA, Packages in 9/Core/Updates_testing: ====================== upx-4.2.3-1.mga9 From SRPMS: upx-4.2.3-1.mga9.src.rpm Assignee:
geiger.david68210 =>
qa-bugs
katnatek
2024-04-10 20:12:06 CEST
Keywords:
(none) =>
advisory Mageia9, x86_64
upx is an executable compression tool.
Made a copy of celestia and compressed it using the 'better' option.
$ ll
total 1360
-rwxr-xr-x 1 lcl lcl 692696 Apr 13 17:15 celestia*
-rwxr-xr-x 1 lcl lcl 692696 Apr 13 17:15 celestia.bak*
$ upx -k -9 -o celestina celestia
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2023
UPX 4.0.2 Markus Oberhumer, Laszlo Molnar & John Reiser Jan 30th 2023
File size Ratio Format Name
-------------------- ------ ----------- -----------
692696 -> 270672 39.08% linux/amd64 celestina
Packed 1 file.
$ ll
total 1628
-rwxr-xr-x 1 lcl lcl 692696 Apr 13 17:15 celestia*
-rwxr-xr-x 1 lcl lcl 692696 Apr 13 17:15 celestia.bak*
-rwxr-xr-x 1 lcl lcl 270672 Apr 13 17:15 celestina*
$ upx -t celestina
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2023
UPX 4.0.2 Markus Oberhumer, Laszlo Molnar & John Reiser Jan 30th 2023
testing celestina [OK]
Tested 1 file.
$ ./celestina
That launched Celestia as normal, without any delay.
So, working OK before update. Updated upx via qarepo...
Tried uncompressing celestina;
$ upx -d -o celestia.copy celestina
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2024
UPX 4.2.3 Markus Oberhumer, Laszlo Molnar & John Reiser Mar 27th 2024
File size Ratio Format Name
-------------------- ------ ----------- -----------
700527 <- 270672 38.64% linux/amd64 celestia.copy
Unpacked 1 file.
$ ll
total 2308
-rwxr-xr-x 1 lcl lcl 692696 Apr 13 17:15 celestia*
-rwxr-xr-x 1 lcl lcl 692696 Apr 13 17:15 celestia.bak*
-rwxr-xr-x 1 lcl lcl 692696 Apr 13 17:15 celestia.copy*
-rwxr-xr-x 1 lcl lcl 270672 Apr 13 17:15 celestina*
and celestia.copy works.
Tried compressing celestia again:
$ upx -1 --lzma -o celestina.new celestia
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2024
UPX 4.2.3 Markus Oberhumer, Laszlo Molnar & John Reiser Mar 27th 2024
File size Ratio Format Name
-------------------- ------ ----------- -----------
692696 -> 238992 34.50% linux/amd64 celestina.new
Packed 1 file.
$ upx -t celestina.new
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2024
UPX 4.2.3 Markus Oberhumer, Laszlo Molnar & John Reiser Mar 27th 2024
testing celestina.new [OK]
Tested 1 file.
$ ./celestina.new
and the compressed version works just like celestia.
There is a lot more to this utility but this should suffice for an OK.
Ran the previous commandsCC:
(none) =>
tarazed25 Validating. Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0134.html Resolution:
(none) =>
FIXED |