KDE KStars FLICCD Utility Multiple Buffer Overflow Vulnerabilities
BID:12570
Info
KDE KStars FLICCD Utility Multiple Buffer Overflow Vulnerabilities
| Bugtraq ID: | 12570 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2005-0011 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 16 2005 12:00AM |
| Updated: | Jul 12 2009 10:06AM |
| Credit: | Erik Sjolund is credited with the discovery of these issues. |
| Vulnerable: |
Redhat Fedora Core3 KDE KDE 3.3.2 KDE KDE 3.3.1 KDE KDE 3.3 Gentoo Linux |
| Not Vulnerable: | |
Discussion
KDE KStars FLICCD Utility Multiple Buffer Overflow Vulnerabilities
Multiple buffer overflow vulnerabilities affect KDE KStar fliccd. These issues are due to a failure of the utility to securely copy user-supplied data into process memory.
An attacker may leverage these issues to gain escalated privileges locally and, if the affected utility is run as a daemon, may facilitate remote code execution with superuser privileges.
Multiple buffer overflow vulnerabilities affect KDE KStar fliccd. These issues are due to a failure of the utility to securely copy user-supplied data into process memory.
An attacker may leverage these issues to gain escalated privileges locally and, if the affected utility is run as a daemon, may facilitate remote code execution with superuser privileges.
Exploit / POC
KDE KStars FLICCD Utility Multiple Buffer Overflow Vulnerabilities
Currently we are not aware of any exploits for these issues. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for these issues. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
KDE KStars FLICCD Utility Multiple Buffer Overflow Vulnerabilities
Solution:
KDE has released a patch dealing with these issues.
Gentoo Linux has released an advisory (GLSA 200502-23) and an updated eBuild to address this vulnerability on Gentoo Linux based computers. A Gentoo user may apply the fix by issuing the following sequence of commands as a superuser:
emerge --sync
emerge --ask --oneshot --verbose ">=kde-base/kdeedu-3.3.2-r1"
Fedora Core 3 advisory FEDORA-2005-148 is available to address this issue. Please see the referenced advisory for more information.
KDE KDE 3.3
KDE KDE 3.3.1
KDE KDE 3.3.2
Solution:
KDE has released a patch dealing with these issues.
Gentoo Linux has released an advisory (GLSA 200502-23) and an updated eBuild to address this vulnerability on Gentoo Linux based computers. A Gentoo user may apply the fix by issuing the following sequence of commands as a superuser:
emerge --sync
emerge --ask --oneshot --verbose ">=kde-base/kdeedu-3.3.2-r1"
Fedora Core 3 advisory FEDORA-2005-148 is available to address this issue. Please see the referenced advisory for more information.
KDE KDE 3.3
-
Fedora kdeedu-3.3.1-2.3.i386.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora kdeedu-3.3.1-2.3.x86_64.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora kdeedu-debuginfo-3.3.1-2.3.i386.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora kdeedu-debuginfo-3.3.1-2.3.x86_64.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora kdeedu-devel-3.3.1-2.3.i386.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora kdeedu-devel-3.3.1-2.3.x86_64.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
KDE post-3.3.2-kdeedu-kstars.diff
ftp://ftp.kde.org/pub/kde/security_patches/post-3.3.2-kdeedu-kstars.di ff
KDE KDE 3.3.1
-
KDE post-3.3.2-kdeedu-kstars.diff
ftp://ftp.kde.org/pub/kde/security_patches/post-3.3.2-kdeedu-kstars.di ff
KDE KDE 3.3.2
-
KDE post-3.3.2-kdeedu-kstars.diff
ftp://ftp.kde.org/pub/kde/security_patches/post-3.3.2-kdeedu-kstars.di ff
References
KDE KStars FLICCD Utility Multiple Buffer Overflow Vulnerabilities
References:
References:
- Instrument Neutral Distributed Interface INDI Home Page (INDI)
- KDE Home Page (KDE)
- KStars (KDE)
- [KDE Security Advisory] Buffer overflow in fliccd of kdeedu/kstars/indi (Dirk Mueller