A local overflow exists in the 'libDtHelp' library in CDE. The 'LOGNAME' environment variable fails to perform proper bounds checking resulting in a buffer overflow. By specifying an overly long LOGNAME, a malicious user can gain access to root privileges resulting in a loss of integrity.
Classification
Location:
Local Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Public
Disclosure:
OSVDB Verified
Technical
This vulnerability occurs in the same sequence of code as the previously
disclosed DTSEARCHPATH and DTUSERSEARCHPATH vulnerabilities. However, the LOGNAME environment variable was not reported as a method of attack in related advisories.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
