Format string vulnerability in Dia 0.94 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filename. NOTE: the original exploit was demonstrated through a command line argument, but there are other mechanisms for input that are automatically processed by Dia, such as a crafted .dia file.

This update fixes CVE-2006-1550, CVE-2006-2453, CVE-2006-2480

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Format string bugs in dia could potentially be exploited to execute arbitrary code (CVE-2006-2453, CVE-2006-2480).

Updated Dia packages that fix several buffer overflow bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Dia drawing program is designed to draw various types of diagrams.

Several format string flaws were found in the way dia displays certain messages. If an attacker is able to trick a Dia user into opening a carefully crafted file, it may be possible to execute arbitrary code as the user running Dia. (CVE-2006-2453, CVE-2006-2480)

Users of Dia should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

The remote host is affected by the vulnerability described in GLSA-200606-03 (Dia: Format string vulnerabilities)

    KaDaL-X discovered a format string error within the handling of     filenames. Hans de Goede also discovered several other format     string errors in the processing of dia files.
  Impact :

    By enticing a user to open a specially crafted file, a remote     attacker could exploit these vulnerabilities to execute arbitrary code     with the rights of the user running the application.
  Workaround :

    There is no known workaround at this time.

A format string vulnerability in Dia allows user-complicit attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filename. NOTE: the original exploit was demonstrated through a command line argument, but there are other mechanisms inputs that are automatically process by Dia, such as a crafted .dia file. (CVE-2006-2480)

Multiple unspecified format string vulnerabilities in Dia have unspecified impact and attack vectors, a different set of issues than CVE-2006-2480. (CVE-2006-2453)

Packages have been patched to correct this issue.

Several format string vulnerabilities have been discovered in dia. By tricking a user into opening a specially crafted dia file, or a file with a specially crafted name, this could be exploited to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
62280	Fedora Extras 5 : dia-0.95-3	Nessus	Fedora Local Security Checks	high
27198	openSUSE 10 Security Update : dia (dia-1435)	Nessus	SuSE Local Security Checks	high
21998	CentOS 4 : dia (CESA-2006:0541)	Nessus	CentOS Local Security Checks	high
21665	GLSA-200606-03 : Dia: Format string vulnerabilities	Nessus	Gentoo Local Security Checks	high
21638	RHEL 4 : dia (RHSA-2006:0541)	Nessus	Red Hat Local Security Checks	high
21617	Mandrake Linux Security Advisory : dia (MDKSA-2006:093)	Nessus	Mandriva Local Security Checks	high
21604	Ubuntu 5.04 / 5.10 : dia vulnerabilities (USN-286-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2006-2480

high

Tenable Plugins

high

high

high

high

high

high

high