WindowMaker Buffer Overflow Vulnerabilities
BID:596
Info
WindowMaker Buffer Overflow Vulnerabilities
| Bugtraq ID: | 596 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-1999-1064 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Aug 23 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | First posted to the RedHat Linux Security mailing list by Stan Bubrouski <[email protected]> on August 23, 1999. |
| Vulnerable: |
Windowmaker Windowmaker 0.53 Windowmaker Windowmaker 0.52 -2 Windowmaker Windowmaker 0.20.1 -3 |
| Not Vulnerable: | |
Discussion
WindowMaker Buffer Overflow Vulnerabilities
There are a number of buffer overflow vulnerabilities known to exist in WindowMaker versions 0.52 and 0.60. These buffer overflows are due to several instances of strcpy() calls without bounds checking. The following section of code (along with other overflowable calls) appears multiple times in the WindowMaker source code:
char buffer[256];
...
...
if (class && instance)
key1 = PLMakeString(strcat(strcat(strcpy(buffer,instance),"."),class));
else
In this example, the buffer 'buffer' can be overflown allowing arbitrary code to be executed.
It may be possible to overflow windowmaker remotely if the X server is configured insecurely.
wmaker is not setuid root by default.
There are a number of buffer overflow vulnerabilities known to exist in WindowMaker versions 0.52 and 0.60. These buffer overflows are due to several instances of strcpy() calls without bounds checking. The following section of code (along with other overflowable calls) appears multiple times in the WindowMaker source code:
char buffer[256];
...
...
if (class && instance)
key1 = PLMakeString(strcat(strcat(strcpy(buffer,instance),"."),class));
else
In this example, the buffer 'buffer' can be overflown allowing arbitrary code to be executed.
It may be possible to overflow windowmaker remotely if the X server is configured insecurely.
wmaker is not setuid root by default.
Exploit / POC
WindowMaker Buffer Overflow Vulnerabilities
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
WindowMaker Buffer Overflow Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].