GTK Shared Memory Permissions Vulnerability
BID:3705
Info
GTK Shared Memory Permissions Vulnerability
| Bugtraq ID: | 3705 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 18 2001 12:00AM |
| Updated: | Dec 18 2001 12:00AM |
| Credit: | Originally discovered by julien vanegue <[email protected]>. |
| Vulnerable: |
XMMS XMMS 1.2.5 GTK GTK+ 1.2.10 |
| Not Vulnerable: | |
Discussion
GTK Shared Memory Permissions Vulnerability
GTK is the Gimp Toolkit, a freely available, open source graphics library program.
When a program linked to GTK is run and creates a shared memory segment, the memory segment is created insecurely. The default implementation of GTK creates all shared memory segments with permissions of 0777. This design gives full read, write, and execute access for any data contained in the segment to all procesess.
XMMS and Mozilla are two examples of applications vulnerable to this problem.
GTK is the Gimp Toolkit, a freely available, open source graphics library program.
When a program linked to GTK is run and creates a shared memory segment, the memory segment is created insecurely. The default implementation of GTK creates all shared memory segments with permissions of 0777. This design gives full read, write, and execute access for any data contained in the segment to all procesess.
XMMS and Mozilla are two examples of applications vulnerable to this problem.
Exploit / POC
GTK Shared Memory Permissions Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
GTK Shared Memory Permissions Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
GTK Shared Memory Permissions Vulnerability
References:
References: