sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] [SMGLSA-2006:2] LibAST: buffer overflow

From: Ladislav Hagara <ladislav.hagara AT unob.cz>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] [SMGLSA-2006:2] LibAST: buffer overflow
Date: Mon, 23 Jan 2006 23:50:29 +0100

Eterm-LibAST Advisory

Eterm is a color vt102 terminal emulator intended as an xterm(1) replacement. Eterm when builded links to LibAST. A stack overflow vulnerability exists in LibAST that allows an attacker to execute commands with user group "utmp". The vulnerability is triggered when using an alternative configuration file name by the '-X' option.

All versions of Eterm using LibAST prior to 0.7 are vulnerable.

Eterm-LibAST Advisory:
http://www.rosiello.org/en/read_bugs.php?id=25

CVE-2006-0224:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0224

-----
All Eterm/LibAST users should:
# scribe update
# cast -c libast

--
Ladislav Hagara

[SM-Security] [SMGLSA-2006:2] LibAST: buffer overflow, Ladislav Hagara, 01/23/2006