Package name
sleuthkit
Date
2013-04-10
Advisory ID
MDVSA-2013:125
Affected versions
MBS1 x86_64

Problem description

Updated sleuthkit packages fix security vulnerabilities:

A security flaw was found in the way the Sleuth Kit (TSK), a collection
of UNIX-based command line tools allowing to investigate a computer,
performed management of \'.\' (dotfile) file system entry. An attacker
could use this flaw to evade detection by forensic analysis (hide
certain files not to be scanned) by renaming the file in question it
to be \'.\' file system entry.

The original reports speaks about this attack vector to be present
when scanning FAT (File Allocation Table) file system. It is possible
though, the flaw to be present on other file systems, which do not
reserve usage of \'.\' entry for special purpose, too.

Updated packages

MBS1 x86_64

 965ee1053bac8a19a064f9c0ad6c4cda  mbs1/x86_64/lib64tsk3_9-4.0.1-1.mbs1.x86_64.rpm
 18f1509bda7d2b6e07a292a094c1edb8  mbs1/x86_64/lib64tsk3-devel-4.0.1-1.mbs1.x86_64.rpm
 d58d0a0e0d8daa64f47d9100ba1f9bbd  mbs1/x86_64/sleuthkit-4.0.1-1.mbs1.x86_64.rpm 
 40930584aa415b849f20557352222dda  mbs1/SRPMS/sleuthkit-4.0.1-1.mbs1.src.rpm

References