GNU less Format String Flaw May Let Users Execute Arbitrary Code
SecurityTracker Alert ID: 1010988|
SecurityTracker URL: http://securitytracker.com/id/1010988
(Links to External Site)
Date: Aug 19 2004
Execution of arbitrary code via local system, Execution of arbitrary code via network, User access via network|
Version(s): 358, 381, 382|
A format string vulnerability was reported in GNU less. A remote user may be able to cause a target user to execute arbitrary code.|
Serkan Akpolat reported that there is a format string error in 'filename.c'. A remote or local user may be able to create a specially crafted file name that, when processed by a target user with less, will trigger the format string flaw and execute arbitrary code. The code will run with the privileges of the target user.
[Editor's note: Arbitrary code execution was not confirmed in the report.]
A remote or local user may be able to cause a target user to execute arbitrary code [however, code execution was not confirmed in the report].|
No solution was available at the time of this entry.|
Vendor URL: www.gnu.org/software/less/less.html (Links to External Site)
Input validation error, State error|
|Underlying OS: Linux (Any), UNIX (Any)|
Source Message Contents
Subject: [Full-Disclosure] gnu-less Format String Vulnerability|
+-----[ Software ]-----+
Less is a program similar to more, but which allows backward movement in
the file as well as forward movement. Also, less does not have to read
the entire input file before starting, so with large input files it
starts up faster than text editors like vi.
Less uses termcap (or terminfo on some systems), so it can run on a
variety of terminals. There is even limited support for hardcopy terminals.
+-----[ Tested Versions ]-----+
+-----[ Description ]-----+
Format string vulnerability.
+-----[ Vulnerable Code ]-----+
[filename.c] : 787
public char *
open_altfile(filename, pf, pfd)
if ((lessopen = lgetenv("LESSOPEN")) == NULL
sprintf(cmd, lessopen, filename); <-- Format String Problem Here
+-----[ Greets ]-------+
Virulent , gorny and all other netricians
+-----[ Contact ]-----+
Full-Disclosure - We believe in it.