(Gentoo Issues Fix) Uim Environment Variables May Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1013340 |
|
SecurityTracker URL: http://securitytracker.com/id/1013340
|
|
CVE Reference:
CAN-2005-0503
(Links to External Site)
|
Date: Mar 1 2005
|
Impact:
Execution of arbitrary code via local system, Root access via local system, User access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 0.4.5.1
|
Description:
A vulnerability was reproted in Uim. A local user may be able to obtain elevated privileges.
The software does not properly validate user-supplied environment variables. If libuim is linked against an application that runs with set user id (setuid) or set group id (setgid) privileges, then a local user may be able to exploit this flaw by setting a specially crafted environment variable and then calling the linked application.
Systems with 'immodule for Qt' enabled Qt are affected.
Takumi ASAKI discovered this vulnerability.
|
Impact:
A local user may be able to obtain elevated privileges.
|
Solution:
Gentoo has released a fix and indicates that all uim users should upgrade to the latest available version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-i18n/uim-0.4.5.1"
|
Vendor URL: freedesktop.org/Software/uim (Links to External Site)
|
Cause:
Access control error, State error
|
Underlying OS:
Linux (Gentoo)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Mon, 28 Feb 2005 17:18:04 +0100
Subject: [gentoo-announce] [ GLSA 200502-31 ] uim: Privilege escalation vulnerability
|
--nextPart5396885.Yyr1AgGVqz
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-31
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: uim: Privilege escalation vulnerability
Date: February 28, 2005
Bugs: #82678
ID: 200502-31
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Under certain conditions, applications linked against uim suffer from a
privilege escalation vulnerability.
Background
==========
uim is a simple, secure and flexible input method library.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-i18n/uim < 0.4.5.1 >= 0.4.5.1
Description
===========
Takumi Asaki discovered that uim insufficiently checks environment
variables. setuid/setgid applications linked against libuim could end
up executing arbitrary code. This vulnerability only affects
immodule-enabled Qt (if you build Qt 3.3.2 or later versions with
USE="immqt" or USE="immqt-bc").
Impact
======
A malicious local user could exploit this vulnerability to execute
arbitrary code with escalated privileges.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All uim users should upgrade to the latest available version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-i18n/uim-0.4.5.1"
References
==========
[ 1 ] CAN-2005-0503
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0503
[ 2 ] uim announcement
http://lists.freedesktop.org/archives/uim/2005-February/000996.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200502-31.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
--nextPart5396885.Yyr1AgGVqz
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
iD8DBQBCI0RFzKC5hMHO6rkRAhfoAKCKK0j+B9wTCXMuP1E91MdNFRVieACeI9uP
PNqHWSycfw6PBg6hlPdUY1Q=
=C19i
-----END PGP SIGNATURE-----
--nextPart5396885.Yyr1AgGVqz--
|
|
