kpopup Local Arguments Format String Vulnerability

Bugtraq ID:	8918
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 28 2003 12:00AM
Updated:	Oct 28 2003 12:00AM
Credit:	Discovery credited to b0f <[email protected]>.
Vulnerable:	Gernot Stocker kpopup 0.9.5 pre2 Gernot Stocker kpopup 0.9.1
Not Vulnerable:

kpopup Local Arguments Format String Vulnerability

It has been alleged that it is possible for local attackers to take advantage of format string vulnerabilities in kpopup, which is installed setuid root by default. According to the report, kpopup does not correctly handle format strings when passed to the program as arguments. This may result in local privilege elevation.

kpopup Local Arguments Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

kpopup Local Arguments Format String Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

kpopup Local Arguments Format String Vulnerability

References:

• Local root vuln in kpopup (b0f www.b0f.net )