[SM-Security] [SMGLSA-2006:2] LibAST: buffer overflow

Ladislav Hagara ladislav.hagara at unob.cz
Mon Jan 23 17:50:29 EST 2006


Eterm-LibAST Advisory

Eterm is a color vt102 terminal emulator intended as an xterm(1) 
replacement. Eterm when builded links to LibAST. A stack overflow 
vulnerability exists in LibAST that allows an attacker to execute 
commands with user group "utmp". The vulnerability is triggered when 
using an alternative configuration file name by the '-X' option.

All versions of Eterm using LibAST prior to 0.7 are vulnerable.

Eterm-LibAST Advisory:
http://www.rosiello.org/en/read_bugs.php?id=25

CVE-2006-0224:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0224


-----
All Eterm/LibAST users should:
# scribe update
# cast -c libast


-- 
Ladislav Hagara






More information about the SM-Security mailing list