Stack-based buffer overflow in the glibtop_get_proc_map_s function in libgtop before 2.14.6 (libgtop2) allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a process with a long filename that is mapped in its address space, which triggers the overflow in gnome-system-monitor.

From Red Hat Security Advisory 2007:0765 :

An updated libgtop2 package that fixes a security issue and a functionality bug is now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libgtop2 package contains a library for obtaining information about a running system, such as cpu, memory and disk usage; active processes; and PIDs.

A flaw was found in the way libgtop2 handled long filenames mapped into the address space of a process. An attacker could execute arbitrary code on behalf of the user running gnome-system-monitor by executing a process and mapping a file with a specially crafted name into the processes' address space. (CVE-2007-0235)

This update also fixes the following bug :

* when a version of libgtop2 compiled to run on a 32-bit architecture was used to inspect a process running in 64-bit mode, it failed to report certain information regarding address space mapping correctly.

All users of gnome-system-monitor are advised to upgrade to this updated libgtop2 package, which contains backported patches that resolve these issues.

A flaw was found in the way libgtop2 handled long filenames mapped into the address space of a process. An attacker could execute arbitrary code on behalf of the user running gnome-system-monitor by executing a process and mapping a file with a specially crafted name into the processes' address space. (CVE-2007-0235)

This update also fixes the following bug :

  - when a version of libgtop2 compiled to run on a 32-bit     architecture was used to inspect a process running in     64-bit mode, it failed to report certain information     regarding address space mapping correctly.

This update fixes a buffer overflow in libgtop's glibtop_get_proc_map_s() function. (CVE-2007-0235)

Liu Qishuai discovered a buffer overflow in the /proc parsing routines in libgtop. By creating and running a process in a specially crafted long path and tricking an user into running gnome-system-monitor, an attacker could exploit this to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2007:0765 advisory.

  - Stack overflow libgtop when pathname of mmap()-ed file is too long (CVE-2007-0235)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An updated libgtop2 package that fixes a security issue and a functionality bug is now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libgtop2 package contains a library for obtaining information about a running system, such as cpu, memory and disk usage; active processes; and PIDs.

A flaw was found in the way libgtop2 handled long filenames mapped into the address space of a process. An attacker could execute arbitrary code on behalf of the user running gnome-system-monitor by executing a process and mapping a file with a specially crafted name into the processes' address space. (CVE-2007-0235)

This update also fixes the following bug :

* when a version of libgtop2 compiled to run on a 32-bit architecture was used to inspect a process running in 64-bit mode, it failed to report certain information regarding address space mapping correctly.

All users of gnome-system-monitor are advised to upgrade to this updated libgtop2 package, which contains backported patches that resolve these issues.

Stack-based buffer overflow in the glibtop_get_proc_map_s function in libgtop before 2.14.6 (libgtop2) allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a process with a long filename that is mapped in its address space, which triggers the overflow in gnome-system-monitor.

The updated packages have been patched to correct this problem.

Liu Qishuai discovered that the GNOME gtop library performs insufficient sanitising when parsing the system's /proc table, which may lead to the execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200701-17 (libgtop: Privilege escalation)

    Liu Qishuai discovered that glibtop_get_proc_map_s() in     sysdeps/linux/procmap.c does not properly allocate memory for storing a     filename, allowing certain filenames to cause the buffer to overflow on     the stack.
  Impact :

    By tricking a victim into executing an application that uses the     libgtop library (e.g. libgtop_daemon or gnome-system-monitor), a local     attacker could specify a specially crafted filename to be used by     libgtop causing a buffer overflow and possibly execute arbitrary code     with the rights of the user running the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
67555	Oracle Linux 4 : libgtop2 (ELSA-2007-0765)	Nessus	Oracle Linux Local Security Checks	low
60240	Scientific Linux Security Update : libgtop2 on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
41116	SuSE9 Security Update : libgtop (YOU Patch Number 11406)	Nessus	SuSE Local Security Checks	low
29502	SuSE 10 Security Update : libgtop (ZYPP Patch Number 2511)	Nessus	SuSE Local Security Checks	low
27995	Ubuntu 5.10 / 6.06 LTS / 6.10 : libgtop2 vulnerability (USN-407-1)	Nessus	Ubuntu Local Security Checks	low
27325	openSUSE 10 Security Update : libgtop (libgtop-2512)	Nessus	SuSE Local Security Checks	low
25877	RHEL 4 : libgtop2 (RHSA-2007:0765)	Nessus	Red Hat Local Security Checks	high
25849	CentOS 4 : libgtop2 (CESA-2007:0765)	Nessus	CentOS Local Security Checks	low
24638	Mandrake Linux Security Advisory : libgtop2 (MDKSA-2007:023)	Nessus	Mandriva Local Security Checks	low
24294	Debian DSA-1255-1 : libgtop2 - buffer overflow	Nessus	Debian Local Security Checks	low
24253	GLSA-200701-17 : libgtop: Privilege escalation	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2007-0235

critical

Tenable Plugins

low

low

low

low

low

low

high

low

low

low

low