Man Catalog File Format String Vulnerability

Bugtraq ID:	7812
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 04 2003 12:00AM
Updated:	Jun 04 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to Vade 79 <[email protected]>.
Vulnerable:	GNU man 1.5.1 + Gentoo Linux 1.4 _rc3 + Gentoo Linux 1.4 _rc2
Not Vulnerable:

Man Catalog File Format String Vulnerability

A vulnerability has been reported in the man utility. The problem is said to occur due to a format string bug when handling a catalog file. As a result, an attacker may be capable of writing arbitrary values to sensitive locations within process memory.

The successful exploitation of this issue could potentially result in a local attacker gaining elevated privileges, likely setgid 'man'.

Man Catalog File Format String Vulnerability

An exploit has been released by Vade 79 <[email protected]>.

• /data/vulnerabilities/exploits/xmanfmt.c

Man Catalog File Format String Vulnerability

Solution:
Gentoo Linux has released an advisory. Users who have installed sys-apps/man are advised to upgrade to man-1.5l-r5 by issuing the following commands:

emerge sync
emerge man
emerge clean

Man Catalog File Format String Vulnerability

References:

• man[v1.5l] catalog format strings patch. (Vade 79 )
  
• man[v1.5l]: (catalog) format strings exploit / POC. (Vade 79 )