CVE-2014-9447

What it actually does

Directory traversal in libelf read_long_names allows a crafted archive containing a slash in a long name entry to cause writes to arbitrary paths under the root directory when processed by affected elfutils versions.

Why it matters to the business

Attackers can overwrite critical system files on servers that ingest untrusted archives through ffmpeg or dependent media tools, leading to service disruption, data corruption, or persistent unauthorized changes; the issue affects many Debian and Ubuntu deployments but has been resolved for years with no active exploitation campaigns observed.

How an attack unfolds

An attacker crafts an archive with a malicious long filename containing a leading slash, then supplies it to any application linked against the vulnerable libelf (such as certain ffmpeg builds) so that the read_long_names function writes attacker-controlled content outside the intended extraction directory.

How to fix it

Upgrade ffmpeg on Debian 11/12/13 to version 2.8.5-1 or later and on Ubuntu 16.04 LTS to 7:2.8.6-1ubuntu1 or later; rebuild any custom packages that statically link the vulnerable elfutils code and verify the libelf version after deployment.

How to confirm the fix worked

Confirm the installed ffmpeg package version matches or exceeds the listed fixed releases, run strings or objdump against libelf to verify the patched read_long_names function, and test with a benign archive containing a slash-prefixed long name to ensure writes remain confined.

Typical attack path

1. Identify a target service or workflow that processes archive files using the affected ffmpeg packages
2. Craft a malicious ar archive containing a long name entry with a leading slash
3. Deliver the archive to the target via upload, download, or automated ingestion
4. Trigger processing so libelf performs the directory traversal write
5. Achieve arbitrary file write under the root filesystem

How to detect it

Review logs from archive ingestion services for unexpected file writes outside designated directories, inspect process execution involving ffmpeg or libelf on untrusted archives, and search filesystem timestamps for files created with names originating from archive entries containing slashes.

What your security team should do

• Immediately verify ffmpeg package versions across all Debian and Ubuntu systems and schedule upgrades to the specified fixed releases
• Scan build pipelines and container images for static linking of old elfutils libraries
• Add archive processing jobs to file-type allow-listing and sandboxing controls
• Monitor EPSS and KEV updates for any resurgence in exploitation despite the age of the flaw