Info

Disclosure

Nov 26, 2005

Discovery

Nov 18, 2005

Dates

Exploit

Unknown

Solution

Unknown

Description

A local overflow exists in ktools. The 'VGETSTRING()' function fails to perform proper bounds checking resulting in a buffer overflow. With a specially crafted request, a malicious user can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Local Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Rumored

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

Konstantin Klyagin

ktools

0.3

References

Bugtraq ID: 15600
Secunia Advisory ID: 17768 18081 20329 20368 20446 21684 23233
CVE ID: 2005-3863 (see also: NVD)
ISS X-Force ID: 23233
VUPEN Advisory: ADV-2005-2605
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-11/0330.html
Vendor URL: http://konst.org.ua/ktools
Other Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200512-11.xml
http://www.gentoo.org/security/en/glsa/glsa-200608-27.xml
http://www.zone-h.org/en/advisories/read/id=8480/
Vendor Specific Advisory URL: http://www.us.debian.org/security/2006/dsa-1083
http://www.us.debian.org/security/2006/dsa-1088
Keyword: ZRCSA-200503

Credit

Mehdi Oudad -
Kevin Fernandez - siegfri3dgmail.com - Zone-H Research Team

Direct URL: http://osvdb.org/21161