Description
An integer overflow in ls in the fileutils or coreutils packages may allow local users to cause a denial of service or execute arbitrary code via a large -w value, which could be remotely exploited via applications that use ls, such as wu-ftpd.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | coreutils | 5.2.1-1 | — |
| Debian 13 | coreutils | 5.2.1-1 | — |
| Debian 12 | coreutils | 5.2.1-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Coreutils 4.5.x - LS Width Argument Integer Overflow EDB-23274 · dos · Oct 22, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- CLA-2003:771 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2005-213.pdf
- CLA-2003:768 vendor-advisory
- 20031022 Fun with /bin/ls, yet still ls better than windows mailing-list
- RHSA-2003:309 vendor-advisory
- TLSA-2003-60 vendor-advisory
- RHSA-2003:310 vendor-advisory
- 8875 vdb-entry
- IMNX-2003-7+-026-01 vendor-advisory
- 17069 third-party-advisory
- http://www.guninski.com/binls.html
- 10126 third-party-advisory
- MDKSA-2003:106 vendor-advisory