Gatos xatitv Missing Configuration File Privilege Escalation Vulnerability

Bugtraq ID:	10437
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2004-0395
Remote:	No
Local:	Yes
Published:	May 29 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	Discovery is credited to Steve Kemp.
Vulnerable:	gatos gatos 0.0.5 - Debian Linux 3.0 sparc - Debian Linux 3.0 s/390 - Debian Linux 3.0 ppc - Debian Linux 3.0 mipsel - Debian Linux 3.0 mips - Debian Linux 3.0 m68k - Debian Linux 3.0 ia-64 - Debian Linux 3.0 ia-32 - Debian Linux 3.0 hppa - Debian Linux 3.0 arm - Debian Linux 3.0 alpha - Debian Linux 3.0
Not Vulnerable:

Gatos xatitv Missing Configuration File Privilege Escalation Vulnerability

The gatos xatitv utility is prone to a local privilege escalation vulnerability.

This issue may occur when the utility, which is installed setuid root, fails to drop privileges due to a missing configuration file. Unsanitized user-supplied environment variables may then be exploited to escalate privileges.

It is noted that the software ships with a default configuration file, so exploitation would require that the file was removed at some point.

Gatos xatitv Missing Configuration File Privilege Escalation Vulnerability

There is no exploit required.

Gatos xatitv Missing Configuration File Privilege Escalation Vulnerability

Solution:
Debian has released fixs for this vulnerability.


gatos gatos 0.0.5

• Debian gatos_0.0.5-6woody1_i386.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/g/gatos/gatos_0.0.5-6wood y1_i386.deb


• Debian libgatos-dev_0.0.5-6woody1_i386.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/g/gatos/libgatos-dev_0.0. 5-6woody1_i386.deb


• Debian libgatos0_0.0.5-6woody1_i386.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/g/gatos/libgatos0_0.0.5-6 woody1_i386.deb

Gatos xatitv Missing Configuration File Privilege Escalation Vulnerability

References:

• gatos Homepage (gatos)