ClanLib Environment Variable Overflow Vulnerability
BID:3877
Info
ClanLib Environment Variable Overflow Vulnerability
| Bugtraq ID: | 3877 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-0125 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 15 2002 12:00AM |
| Updated: | Jul 11 2009 09:56AM |
| Credit: | Published on the BugTraq mailing list by KF <[email protected]>. |
| Vulnerable: |
ClanLib ClanLib 5.0 |
| Not Vulnerable: | |
Discussion
ClanLib Environment Variable Overflow Vulnerability
ClanLib is a cross platform game development library. It includes many common low level functions related to graphics, sound and resource management. It has been released for several Linux distributions, as well as Microsoft Windows.
A vulnerability exists in ClanLib's handling of extremely long environment variables. Under some circumstances, an overflow condition will occur, resulting in the instruction pointer being corrupted. Execution of arbitrary code as user or group 'games' may be possible on some systems.
Other versions of ClanLib may share this vulnerability. Further technical details are not available at this time.
ClanLib is a cross platform game development library. It includes many common low level functions related to graphics, sound and resource management. It has been released for several Linux distributions, as well as Microsoft Windows.
A vulnerability exists in ClanLib's handling of extremely long environment variables. Under some circumstances, an overflow condition will occur, resulting in the instruction pointer being corrupted. Execution of arbitrary code as user or group 'games' may be possible on some systems.
Other versions of ClanLib may share this vulnerability. Further technical details are not available at this time.
Solution / Fix
ClanLib Environment Variable Overflow Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.