[Frugalware-security] [ FSA-669 ] gnustep-base
vmiklos at frugalware.org
Wed May 12 18:28:18 CEST 2010
-----BEGIN PGP SIGNED MESSAGE-----
Frugalware Security Advisory FSA-669
Vulnerable versions: <= 1.18.0-1
Unaffected versions: >= 1.18.0-2locris1
Related bugreport: http://bugs.frugalware.org/task/4210
Two vulnerabilities have been reported in GNUStep Base, which can be exploited by malicious, local users to potentially gain escalated privileges or disclose sensitive information.
1) The "gdomap" application includes the content of files in error messages when parsing a configuration file specified via the "-c" command line option. This can be exploited to disclose sensitive information by passing an arbitrary file as configuration file to the application.
2) An integer overflow error exists in the "gdomap" application when parsing configuration files. This can be exploited to cause a heap-based buffer overflow when a specially crafted configuration file containing a large number lines is being processed.
Successful exploitation of the vulnerabilities requires that the "gdomap" binary has the "setuid" bit set and is owned by e.g. root.
Check if you have gnustep-base installed:
# pacman-g2 -Q gnustep-base
If found, then you should upgrade to the latest version:
# pacman-g2 -Sy gnustep-base
The latest revision of this advisory is available at
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: See http://ftp.frugalware.org/pub/README.GPG for info
-----END PGP SIGNATURE-----
More information about the Frugalware-security