GNU ed strip_escapes() buffer overflow
| gnued-stripescapes-bo (44643) |  High Risk |
Description:
GNU ed is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the strip_escapes() function. By persuading a victim to open a specially-crafted file, a remote attacker could overflow a buffer and execute arbitrary code on the system.
Platforms Affected:
- Gentoo, Linux
- GNU, ed 0.2
- GNU, ed 0.3
- GNU, ed 0.4
- GNU, ed 0.5
- GNU, ed 0.6
- GNU, ed 0.7
- GNU, ed 0.8
- GNU, ed 0.9
- MandrakeSoft, Mandrake Linux 2007.1 X86_64
- MandrakeSoft, Mandrake Linux 2007.1
- MandrakeSoft, Mandrake Linux 2008.0
- MandrakeSoft, Mandrake Linux 2008.0 X86_64
- MandrakeSoft, Mandrake Linux 2008.1 X86_64
- MandrakeSoft, Mandrake Linux 2008.1
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 5
- RedHat, Enterprise Linux 5 Client
- RedHat, Linux Advanced Workstation 2.1 Itanium
Remedy:
Upgrade to the latest version of GNU ed (1.0 or later), available from the GNU Web site. See References.
Consequences:
Gain Access
References:
- GNU Web site, ed - A line-oriented text editor at http://www.gnu.org/software/ed/ed.html.
- gnu-announce Mailing List, Aug 21, 2008 12:20, Version 1.0 of GNU ed released at http://www.nnseek.com/e/gnu.announce/version_1_0_of_gnu_ed_released_120616693t.html.
- ASA-2008-461: ed security update (RHSA-2008-0946)
- BID-30815: GNU ed File Processing 'strip_escapes()' Heap Overflow Vulnerability
- CVE-2008-3916: Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attackers to execute arbitrary code via a long filename. NOTE: since ed itself does not typically run with special privileges, this issue only crosses privilege boundaries when ed is invoked as a third-party component.
- GLSA-200809-15: GNU ed: User-assisted execution of arbitrary code
- MDVSA-2008:200: ed
- RHSA-2008-0946: Moderate: ed security update
- SA33005: Avaya Products ed "strip_escapes()" Buffer Overflow Security Issue
- SECTRACK ID: 1020734: GNU ed Heap Overflow in strip_escapes() Lets Remote Users Execute Arbitrary Code
- VUPEN/ADV-2008-2642: GNU ed strip_escapes() Function Buffer Overflow Vulnerability
- VUPEN/ADV-2008-3347: Avaya Products GNU ed strip_escapes() Buffer Overflow Vulnerability
Reported:
Aug 21, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net