GnuCash Insecure Excutable File Loading Arbitrary Code Execution Vulnerability

Bugtraq ID:	49487
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 07 2011 12:00AM
Updated:	Sep 07 2011 12:00AM
Credit:	Mister Teatime
Vulnerable:	GnuCash GnuCash 2.4.7 r20813
Not Vulnerable:

GnuCash Insecure Excutable File Loading Arbitrary Code Execution Vulnerability

GnuCash is prone to a vulnerability that lets attackers execute arbitrary code.

A successful exploit can allow the attacker to execute arbitrary program in the context of the user running the affected application.

GnuCash 2.4.7 r20813 running on Windows is vulnerable. Other versions may also be affected.

GnuCash Insecure Excutable File Loading Arbitrary Code Execution Vulnerability

Attackers must entice an unsuspecting user into opening a '.gnucash' file on a remote WebDAV or SMB share to exploit this issue.

GnuCash Insecure Excutable File Loading Arbitrary Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GnuCash Insecure Excutable File Loading Arbitrary Code Execution Vulnerability

References:

• Product Homepage (GnuCash)