splitvt stack buffer overflow
| linux-splitvt (430) |  High Risk |
Description:
Splitvt is vulnerable to a buffer overflow in the HOME environment variable. A local attacker can overflow the stack and execute arbitrary code on the system as root.
Consequences:
Gain Privileges
Remedy:
Upgrade to the latest version of splitvt (1.6.3 or later), as listed in CERT Vendor-Initiated Bulletin VB-96.01. See References.
References:
- CIAC Information Bulletin G-08: splitvt(1) vulnerability.
- NCNU CERT Vendor-Initiated Bulletin VB-96.01: Newest version of splitvt.
- CVE-1999-0316: Buffer overflow in Linux splitvt command gives root access to local users.
- OSVDB ID: 11501: Linux splitvt parserc.c Local Overflow
- OSVDB ID: 19061: Linux splitvt vtmouse.c Local Overflow
Platforms Affected:
- Debian Debian Linux 2.1
- Debian Debian Linux 2.2
- Debian Debian Linux 2.3
- Devolution splitvt 1.6.3
- HP HP-UX 10.20
- HP HP-UX 11
- IBM AIX 4
- Linux Kernel
- RedHat Linux 6.0
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.2
- RedHat Linux 7.3
- Sun Solaris 2.5.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8
Reported:
Dec 01, 1995
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this