Note: This is an archival copy of Security Sun Alert 200539 as previously published on
Latest version of this security advisory is available from as Sun Alert 1000411.1.
Article ID : 1000411.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2003-08-04
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Sun Linux 5.0 Vulnerability in "file" Utility May Allow a Local Unprivileged User to Execute Arbitrary Code


Release Phase

Sun Cobalt Qube 3 Server
Sun Cobalt RaQ XTR Server
Sun Cobalt RaQ 4 Server
Sun Cobalt RaQ 550 Server

Bug Id

Date of Resolved Release


The Sun Linux 5.0 file(1) utility version 3.39 and earlier contains a buffer overflow vulnerability in the Executable and Linking Format (ELF) parsing routines. This vulnerability may allow a local unprivileged user to execute arbitrary code with the privileges of the user running the file(1) command.

Note: The file(1) command is used to identify a particular file according to the type of data contained in it.

More information on this issue is available at:

Contributing Factors

This issue can occur in the following releases:

Sun Linux Platform

  • Sun Linux 5.0 with file(1) version 3.39 and earlier

Sun Cobalt Appliances

  • Qube3 with file(1) version 3.39 and earlier
  • RaQ4 with file(1) version 3.39 and earlier
  • RaQXTR with file(1) version 3.39 and earlier
  • RaQ550 with file(1) version 3.39 and earlier

The file(1) package version can be determined by running the following command:

    $ rpm -q file

Note: Sun Linux 5.0 is currently shipped with the Sun LX50 Server.


There are no predictable symptoms that would indicate the described issue has been exploited.


To work around the described issue until patches can be applied, disable file(1) by removing executable and all other permissions from the "/usr/bin/file" file:

To remove permissions:

    $ chmod 000 /usr/bin/file

To restore permissions:

    $ chmod 755 /usr/bin/file


This issue is addressed in the following release:

Sun Linux Platform

  • Sun Linux 5.0 with file(1) version 3.39-8.7x or later

Sun Linux patches are available at:

Sun Cobalt Appliances

Patches for Qube3, RaQ4, RaQ550 and RaQXTR are available at:

Modification History
Date: 13-APR-2005
  • State changed to Resolved

Date: 29-AUG-2003
  • Updated Resolution section

This solution has no attachment