XWine WINE Configuration File Local Arbitrary Command Execution Vulnerability

Bugtraq ID:	28369
Class:	Design Error
CVE:	CVE-2008-0931
Remote:	No
Local:	Yes
Published:	Mar 20 2008 12:00AM
Updated:	Mar 25 2008 02:09PM
Credit:	Steve Kemp from the Debian Security Audit project
Vulnerable:	Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Darken33 XWine 1.0.1 + Debian Linux 4.0 sparc + Debian Linux 4.0 s/390 + Debian Linux 4.0 powerpc + Debian Linux 4.0 mipsel + Debian Linux 4.0 mips + Debian Linux 4.0 m68k + Debian Linux 4.0 ia-64 + Debian Linux 4.0 ia-32 + Debian Linux 4.0 hppa + Debian Linux 4.0 arm + Debian Linux 4.0 amd64 + Debian Linux 4.0 alpha + Debian Linux 4.0
Not Vulnerable:

XWine WINE Configuration File Local Arbitrary Command Execution Vulnerability

XWine is prone to a vulnerability that can allow local attackers to execute arbitrary commands.

Local attackers can exploit this issue to execute arbitrary commands whenever a local user executes a program under WINE.

This issue affects XWine 1.0.1; other versions may also be vulnerable.

XWine WINE Configuration File Local Arbitrary Command Execution Vulnerability

Attackers can use readily available tools to launch attacks.

XWine WINE Configuration File Local Arbitrary Command Execution Vulnerability

Solution:
Fixes are available to address this issue. Please see the references for more information.

XWine WINE Configuration File Local Arbitrary Command Execution Vulnerability

References:

• Overview of xwine source package (Debian)