AIDE 0.16 through 0.19.4 ignores invalid UTF-8 file names
Original title: aide (>= 0.16 <= 0.19.4) improper handling of file names containing invalid UTF-8 byte sequences (AIDE detection bypass) [GHSA-wq25-fm54-5q3q, CVE pending]
A local user can hide files or directories from the integrity checker; a CVE is still pending.
Rajesh Pangare found that AIDE, a host-based file and directory integrity checker, mishandles names containing invalid UTF-8 byte sequences. Versions from 0.16 through 0.19.4 can silently ignore a crafted file or directory, so a local user can bypass detection of malicious files. The report is tracked as GHSA-wq25-fm54-5q3q, with a CVE still pending.
Unconfirmed: A CVE has not been assigned yet.
- Hannes von Haugwitz posted the report on October 22.
- Affected range is AIDE 0.16 through 0.19.4.
- The advisory identifier given is GHSA-wq25-fm54-5q3q.
- No fixed version is stated in the post.
Impact: local bypass of file and directory integrity checks
| Product | Affected |
|---|---|
| AIDE | >= 0.16 <= 0.19.4 |
- Products
- AIDE
From the original article
Posted by Hannes von Haugwitz on Oct 22 Summary ======= Rajesh Pangare discovered that AIDE, a host-based file and directory integrity checker, improperly handles file names with invalid UTF-8 byte sequences. An attacker can craft a malicious file or directory name by including invalid UTF-8 bytes so that the file/directory is silently ignored by AIDE.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.