Yelp Invalid URI Format String Vulnerability
BID:30690
Info
Yelp Invalid URI Format String Vulnerability
| Bugtraq ID: | 30690 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-3533 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 13 2008 12:00AM |
| Updated: | Apr 13 2015 08:58PM |
| Credit: | Aaron Grattafiori |
| Vulnerable: |
Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 S.u.S.E. openSUSE 11.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 GNOME yelp 2.23.1 Gentoo Linux |
| Not Vulnerable: | |
Discussion
Yelp Invalid URI Format String Vulnerability
Yelp is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function.
A remote attacker may exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts may cause denial-of-service conditions.
Yelp 2.23.1 is vulnerable; other versions may also be affected.
Yelp is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function.
A remote attacker may exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts may cause denial-of-service conditions.
Yelp 2.23.1 is vulnerable; other versions may also be affected.
Exploit / POC
Yelp Invalid URI Format String Vulnerability
The following proof-of-concept URIs are available:
ftp://%08x.%08x.%08x.%08x.%08x.%08x
%x%x%x%x%x%x://
%08x%08x
The following proof-of-concept URIs are available:
ftp://%08x.%08x.%08x.%08x.%08x.%08x
%x%x%x%x%x%x://
%08x%08x
Solution / Fix
Yelp Invalid URI Format String Vulnerability
Solution:
Fixes are available in the SVN repository. Please see the references for more information.
Ubuntu Ubuntu Linux 7.10 i386
Mandriva Linux Mandrake 2008.1 x86_64
Ubuntu Ubuntu Linux 7.10 powerpc
Mandriva Linux Mandrake 2008.1
Ubuntu Ubuntu Linux 8.04 LTS powerpc
Ubuntu Ubuntu Linux 7.10 amd64
Ubuntu Ubuntu Linux 8.04 LTS i386
Mandriva Linux Mandrake 2008.0 x86_64
Ubuntu Ubuntu Linux 8.04 LTS amd64
Mandriva Linux Mandrake 2008.0
Ubuntu Ubuntu Linux 7.10 sparc
Ubuntu Ubuntu Linux 8.04 LTS lpia
Ubuntu Ubuntu Linux 7.10 lpia
Solution:
Fixes are available in the SVN repository. Please see the references for more information.
Ubuntu Ubuntu Linux 7.10 i386
-
Ubuntu yelp_2.20.0-0ubuntu3.1_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/y/yelp/yelp_2.20.0-0ubuntu 3.1_i386.deb
Mandriva Linux Mandrake 2008.1 x86_64
-
Mandriva yelp-2.22.0-2.4mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/
Ubuntu Ubuntu Linux 7.10 powerpc
-
Ubuntu yelp_2.20.0-0ubuntu3.1_powerpc.deb
http://security.ubuntu.com/ubuntu/pool/main/y/yelp/yelp_2.20.0-0ubuntu 3.1_powerpc.deb
Mandriva Linux Mandrake 2008.1
-
Mandriva yelp-2.22.0-2.4mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/
Ubuntu Ubuntu Linux 8.04 LTS powerpc
-
Ubuntu yelp_2.22.1-0ubuntu2.8.04.3_powerpc.deb
http://ports.ubuntu.com/pool/main/y/yelp/yelp_2.22.1-0ubuntu2.8.04.3_p owerpc.deb
Ubuntu Ubuntu Linux 7.10 amd64
-
Ubuntu yelp_2.20.0-0ubuntu3.1_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/y/yelp/yelp_2.20.0-0ubuntu 3.1_amd64.deb
Ubuntu Ubuntu Linux 8.04 LTS i386
-
Ubuntu yelp_2.22.1-0ubuntu2.8.04.3_i386.deb
http://security.ubuntu.com/ubuntu/pool/main/y/yelp/yelp_2.22.1-0ubuntu 2.8.04.3_i386.deb
Mandriva Linux Mandrake 2008.0 x86_64
-
Mandriva yelp-2.20.0-3.7mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/
Ubuntu Ubuntu Linux 8.04 LTS amd64
-
Ubuntu yelp_2.22.1-0ubuntu2.8.04.3_amd64.deb
http://security.ubuntu.com/ubuntu/pool/main/y/yelp/yelp_2.22.1-0ubuntu 2.8.04.3_amd64.deb
Mandriva Linux Mandrake 2008.0
-
Mandriva yelp-2.20.0-3.7mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/
Ubuntu Ubuntu Linux 7.10 sparc
-
Ubuntu yelp_2.20.0-0ubuntu3.1_sparc.deb
http://security.ubuntu.com/ubuntu/pool/main/y/yelp/yelp_2.20.0-0ubuntu 3.1_sparc.deb
Ubuntu Ubuntu Linux 8.04 LTS lpia
-
Ubuntu yelp_2.22.1-0ubuntu2.8.04.3_lpia.deb
http://ports.ubuntu.com/pool/main/y/yelp/yelp_2.22.1-0ubuntu2.8.04.3_l pia.deb
Ubuntu Ubuntu Linux 7.10 lpia
-
Ubuntu yelp_2.20.0-0ubuntu3.1_lpia.deb
http://ports.ubuntu.com/pool/main/y/yelp/yelp_2.20.0-0ubuntu3.1_lpia.d eb
References
Yelp Invalid URI Format String Vulnerability
References:
References:
- Bug 546364 �?? yelp format string vulnerability (Gnome)
- Yelp Homepage (Gnome)