YaST2 Utility Library File Verification Shell Code Injection Vulnerability

Bugtraq ID:	10867
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 04 2004 12:00AM
Updated:	Aug 04 2004 12:00AM
Credit:	The individual responsible for the discovery of this issue is currently unknown; his issue was disclosed in the referenced SuSE libPNG advisory.
Vulnerable:	SuSE YaST2 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + SuSE Linux 8.1
Not Vulnerable:

YaST2 Utility Library File Verification Shell Code Injection Vulnerability

YaST2 utility library 'liby2util' is affected by a file verification shell code injection vulnerability. This issue is due to a design error that fails to properly validate files.

An attacker could leverage this issue to inject malicious shell code into a file name being transferred using the vulnerable utility. This might facilitate privilege escalation and unauthorized access.

YaST2 Utility Library File Verification Shell Code Injection Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

YaST2 Utility Library File Verification Shell Code Injection Vulnerability

Solution:
S.u.S.E. has made updated binaries available on their FTP sites.

YaST2 Utility Library File Verification Shell Code Injection Vulnerability

References:

• The YaST2 Package Manager (SuSE)