GNU AN Local Command Line Option Buffer Overflow Vulnerability

Bugtraq ID:	8099
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 03 2003 12:00AM
Updated:	Jul 03 2003 12:00AM
Credit:	Discovery of this vulnerability credited to t0asty [ [email protected] ].
Vulnerable:	GNU Ant 0
Not Vulnerable:

GNU AN Local Command Line Option Buffer Overflow Vulnerability

A local buffer overflow has been reported for GNU an that may result in an attacker potentially obtaining elevated privileges.

The vulnerability exists due to insufficient boundary checks performed on some commandline options. Successful exploitation may result in the execution of attacker-supplied code. Privilege escalation may be possible on systems where the utility is installed setuid/setgid.

GNU AN Local Command Line Option Buffer Overflow Vulnerability

The following exploit was provided:

• /data/vulnerabilities/exploits/5358gnuanx0r.c

GNU AN Local Command Line Option Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

GNU AN Local Command Line Option Buffer Overflow Vulnerability

References: