GTK+ Arbitrary Loadable Module Execution Vulnerability
BID:2165
Info
GTK+ Arbitrary Loadable Module Execution Vulnerability
| Bugtraq ID: | 2165 |
| Class: | Design Error |
| CVE: |
CVE-2001-0084 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 02 2001 12:00AM |
| Updated: | Jul 11 2009 04:46AM |
| Credit: | This vulnerability was announced by v9 <[email protected]> on January 2, 2001 via the Bugtraq. |
| Vulnerable: |
GTK GTK+ 1.2.8 |
| Not Vulnerable: | |
Solution / Fix
GTK+ Arbitrary Loadable Module Execution Vulnerability
Solution:
A temporary fix is to add the following line of code to line 215 (approximately in GTK 1.2.8 ) of source file gtkmain. The line should read as follows:
env_string = getenv ("GTK_MODULES");
The following line should be added above it:
if(geteuid() == getuid())
Solution:
A temporary fix is to add the following line of code to line 215 (approximately in GTK 1.2.8 ) of source file gtkmain. The line should read as follows:
env_string = getenv ("GTK_MODULES");
The following line should be added above it:
if(geteuid() == getuid())