----------------------------------------------------------------------


Looking for a job?


Secunia is hiring skilled researchers and talented developers.


http://secunia.com/company/jobs/


----------------------------------------------------------------------

TITLE:
GNUStep Base "gdomap" Integer Overflow and Information Disclosure

SECUNIA ADVISORY ID:
SA39746

VERIFY ADVISORY:
http://secunia.com/advisories/39746/

DESCRIPTION:
Two vulnerabilities have been reported in GNUStep Base, which can be
exploited by malicious, local users to potentially gain escalated
privileges or disclose sensitive information.

1) The "gdomap" application includes the content of files in error
messages when parsing a configuration file specified via the "-c"
command line option. This can be exploited to disclose sensitive
information by passing an arbitrary file as configuration file to the
application.

2) An integer overflow error exists in the "gdomap" application when
parsing configuration files. This can be exploited to cause a
heap-based buffer overflow when a specially crafted configuration
file containing a large number lines is being processed.

Successful exploitation of the vulnerabilities requires that the
"gdomap" binary has the "setuid" bit set and is owned by e.g. root.

SOLUTION:
Update to version 1.20.0.

PROVIDED AND/OR DISCOVERED BY:
Dan Rosenberg

ORIGINAL ADVISORY:
Dan Rosenberg:
http://thread.gmane.org/gmane.comp.lib.gnustep.bugs/12336
http://thread.gmane.org/gmane.comp.lib.gnustep.bugs/12336

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------