Uim Input Validation Flaw in Environment Variables May Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1015002
|
|
SecurityTracker URL: http://securitytracker.com/id?1015002
|
|
CVE Reference: CVE-2005-3149
(Links to External Site)
|
Updated: Jun 14 2008
|
Original Entry Date: Oct 5 2005
|
Impact: Execution of arbitrary code via local system, Root access via local system, User access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 0.4.9.1
|
Description: A vulnerability was reported in Uim. A local user may be able to gain elevated privileges on the target system.
The Uim library does not properly validate user-supplied inputs in environment variables. A local user can supply a specially crafted
value to cause an affected application to execute arbitrary code with the privileges of the target application.
Applications
that are configured with set user id (setuid) or set group id (setgid) privileges and are linked to libuim may be affected.
Only
immodule-enabled Qt is affected.
Version 0.5.0.1 is not affected.
Masanari Yamamoto discovered this vulnerability.
|
Impact: A local user may be able to execute arbitrary code with elevated privileges.
|
Solution: The vendor has issued a fixed version (0.4.9.1), available at:
http://uim.freedesktop.org/releases/uim-0.4.9.1.tar.gz
sha1sum:9037499c47187aeee758ee2bfd60ba9d7d4f40ec uim-0.4.9.1.tar.gz
|
Vendor URL: uim.freedesktop.org/wiki/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: tkng@xem.jp (TOKUNAGA Hiroyuki)
|
Message History:
None.
|
Source Message Contents
|
Date: Wed Sep 28 05:46:08 PDT 2005
From: tkng@xem.jp (TOKUNAGA Hiroyuki)
Subject: [Uim] uim-0.4.9.1 released
|
uim-0.4.9.1 is released. This release is for *security fix*.
http://uim.freedesktop.org/releases/uim-0.4.9.1.tar.gz
sha1sum:9037499c47187aeee758ee2bfd60ba9d7d4f40ec uim-0.4.9.1.tar.gz
All uim releases except 0.4.9.1 and 0.5.0.1 have a security hole.
If you are using setuid/setgid application which is linked to libuim,
you have to upgrade uim.
Brief of the bug
================
Vulnerability : privilege escalation
Problem-Type : local
Masanari Yamamoto discovered that incorrect use of environment
variables in uim. This bug causes privilege escalation if setuid/setgid
applications was linked to libuim.
This bug appears in 'immodule for Qt' enabled Qt. (Normal Qt is also
safe.) In some distribution, mlterm is also an setuid/setgid
application.
Changes between 0.4.9 to 0.4.9.1
================================
* Fixed incorrect use of environment variables.
|
|
