Bug 130698 (CVE-2005-2958)

We received the following report via vendor-sec.
The issue is public.

Date: Tue, 25 Oct 2005 18:20:47 +0200
From: Martin Schulze <joey@infodrom.org>
To: Free Software Distribution Vendors <vendor-sec@lst.de>
Subject: [vendor-sec] CAN-2005-2958: libgda2 syslog format string attack

Hmm, it seems this issue has never made it to vendor sec.  Sorry
for that.


From Steve Kemp:

libgda2 format string attack
----------------------------

  The gda2 library contains two format string bugs, both involving the
 use of the syslog function.

  The relevent code is contained in the file:

      libgda2-1.2.1/libgda/gda-log.c

  The two functions gda_log_error and gda_log_message both contain
 this code:

      syslog (LOG_USER | LOG_INFO, msg);


Exploitation
------------

  The logging functions are called throughout the code and are
 often passed user controllable input.  For example:

gda-xml-database.c:
 gda_log_error (_("Invalid XML database file '%s'"), uri);

  or

gda-select.c:
 gda_log_error (_("Could not parse SQL string '%s'"), sel->priv->sql);


  Whilst it is not likely that privileges could be gained by the
 libary alone there are several routes for exploitation via other
 applications which link to the code.

  The most obvious is the "gnumeric-plugins-extra" package which
 links to and uses the code.

 

Fix
---

  The following patch fixes this:

--- gda-log.c-orig      2005-09-06 13:49:52.792070192 +0100
+++ gda-log.c   2005-09-06 13:50:25.049166368 +0100
@@ -111,7 +111,7 @@
 #ifdef LIBGDA_WIN32
        g_log ("Gda", G_LOG_LEVEL_INFO, "%s", msg);
 #else
-       syslog (LOG_USER | LOG_INFO, msg);
+       syslog (LOG_USER | LOG_INFO, "%s", msg);
 #endif
        g_free (msg);
 }
@@ -144,7 +144,7 @@
 #ifdef LIBGDA_WIN32
        g_log ("Gda", G_LOG_LEVEL_ERROR, "%s", msg);
 #else
-       syslog (LOG_USER | LOG_ERR, msg);
+       syslog (LOG_USER | LOG_ERR, "%s", msg);
 #endif
        g_free (msg);
 }

Steve
-- 
# The Debian Security Audit Project.
http://www.debian.org/security/audit

Regards,

	Joey


-- 
MIME - broken solution for a broken design.  -- Ralf Baechle