Info

Disclosure

Aug 31, 2006

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

A remote overflow exists in GDB DWARF. The compiler fails to handle 'DWARF' or 'DWARF2' information resulting in a buffer overflow. With a specially crafted request, an attacker can execute arbitrary code resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown
Disclosure: Vendor Verified

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Red Hat has released a patch to address this vulnerability.

Products

GNU

GDB

6.5

References

CVE ID: 2006-4146 (see also: NVD)
Secunia Advisory ID: 21713 22205 22662 25098 25632 25894 25934 26909 27706
SCIP VulDB ID: 2505
Other Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc http://support.avaya.com/elmodocs2/security/ASA-2007-253.htm
http://www.gentoo.org/security/en/glsa/glsa-200711-23.xml
Vendor Specific Advisory URL: http://docs.info.apple.com/article.html?artnum=304669
http://www.ubuntu.com/usn/usn-356-1
Vendor Specific News/Changelog Entry: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=204845
RedHat RHSA: RHSA-2007:0203 RHSA-2007:0469

Credit

Will Drewry - wadgoogle.com - Google Security Team

Direct URL: http://osvdb.org/28318