Window Maker WMGLOBAL Font Specification Format String Vulnerability

Bugtraq ID:	11512
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 25 2004 12:00AM
Updated:	Oct 25 2004 12:00AM
Credit:	This issue was announced by the vendor.
Vulnerable:	Windowmaker Windowmaker 0.80.2 Windowmaker Windowmaker 0.80 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Redhat Linux 8.0 i386 + Redhat Linux 8.0 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 + Sun Linux 5.0 Windowmaker Windowmaker 0.65.1 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 Windowmaker Windowmaker 0.65 + Redhat Enterprise Linux AS 2.1 + Redhat Linux Advanced Work Station 2.1 Windowmaker Windowmaker 0.64 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 + Sun Linux 5.0.6 Windowmaker Windowmaker 0.63.1 Windowmaker Windowmaker 0.63 Windowmaker Windowmaker 0.62.1 + Mandriva Linux Mandrake 7.2 Windowmaker Windowmaker 0.62 Windowmaker Windowmaker 0.61.1 + Redhat Linux 6.2 i386 + Redhat Linux 6.2 Windowmaker Windowmaker 0.61 + Debian Linux 2.2 - MandrakeSoft Corporate Server 1.0.1 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 Windowmaker Windowmaker 0.60 Windowmaker Windowmaker 0.53 + FreeBSD FreeBSD 3.2 Windowmaker Windowmaker 0.52 -2 + Redhat Linux 6.0 Windowmaker Windowmaker 0.20.1 -3 + Redhat Linux 5.2 i386
Not Vulnerable:	Windowmaker Windowmaker 0.90 .0

Window Maker WMGLOBAL Font Specification Format String Vulnerability

A format string vulnerability has been reported in Window Maker related to validation of font specifications in the WMGLOBAL configuration file. A user could potentially include malicious format specifiers through font specifications in the WMGLOBAL configuration file.

The vulnerability would be triggered when the configuration file is read by the program, potentially allowing arbitrary code execution in the context of the program.

Window Maker WMGLOBAL Font Specification Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Window Maker WMGLOBAL Font Specification Format String Vulnerability

Solution:
This vulnerability has been addressed in Window Maker 0.90.0.


Windowmaker Windowmaker 0.20.1 -3

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.52 -2

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.53

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.60

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.61

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.61.1

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.62

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.62.1

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.63

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.63.1

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.64

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.65

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.65.1

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.80

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Windowmaker Windowmaker 0.80.2

• Window Maker WindowMaker-0.90.0.tar.gz
  ftp://windowmaker.org/pub/source/release/WindowMaker-0.90.0.tar.gz

Window Maker WMGLOBAL Font Specification Format String Vulnerability

References:

• Window Maker Homepage (Window Maker)