Bug 64899 (CVE-2005-0076)

Hello, 
we received the following *non-public* report. 
 
From: Martin Schulze <joey@infodrom.org> 
To: Free Software Distribution Vendors <vendor-sec@lst.de> 
User-Agent: Mutt/1.5.6+20040907i 
Subject: [vendor-sec] CAN-2005-0076: Potentional arbitrary code execution 
in xview 
Errors-To: vendor-sec-admin@lst.de 
Date: Sat, 15 Jan 2005 17:37:59 +0100 
 
Erik Sjölund discovered that programs linked against xview are 
vulnerable to a number of buffer overflows in the XView library.  When 
the overflow is triggered in a program which is installed setuser root 
a malicious user could perhaps execute arbitrary code as privileged 
user. 
 
These commands will create a segmentation fault: 
 
$ ln -s  /usr/X11R6/bin/xvmount  /tmp/`perl -e 'print "A" x 200'` 
$  /tmp/`perl -e 'print "A" x 200'`  -Wt 
 
The overflowed variable seems to be sufficiently far away from the 
stack frame, but I'm not totally sure that it is impossible to 
overwrite it as well.  I'm attaching a proposed patch. 
 
Please let me know if you need coordination for this bug. 
This package is probably part of most other distributions as well. 
 
Regards, 
 
        Joey 
 
-- 
There are lies, statistics and benchmarks.