Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.

This update of yelp fixes a format string bug. (CVE-2008-3533)

A format string vulnerability was discovered in yelp after version 2.19.90 and before 2.24 that could allow remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command-line or via URI helpers in Firefox, Evolution, or possibly other programs (CVE-2008-3533).

The updated packages have been patched to correct this issue.

This update fixes a format string vulnerability that was discovered in yelp 2.20.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200809-01 (yelp: User-assisted execution of arbitrary code)

    Aaron Grattafiori reported a format string vulnerability in the     window_error() function in yelp-window.c.
  Impact :

    A remote attacker can entice a user to open specially crafted 'man:' or     'ghelp:' URIs in yelp, or an application using yelp such as Firefox or     Evolution, and execute arbitrary code with the privileges of that user.
  Workaround :

    There is no known workaround at this time.

Aaron Grattafiori discovered that the Gnome Help Viewer did not handle format strings correctly when displaying certain error messages. If a user were tricked into opening a specially crafted URI, a remote attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
40162	openSUSE Security Update : yelp (yelp-271)	Nessus	SuSE Local Security Checks	critical
37661	Mandriva Linux Security Advisory : yelp (MDVSA-2008:175)	Nessus	Mandriva Local Security Checks	critical
34126	Fedora 8 : yelp-2.20.0-12.fc8 (2008-7293)	Nessus	Fedora Local Security Checks	critical
34090	GLSA-200809-01 : yelp: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
34059	Ubuntu 7.10 / 8.04 LTS : yelp vulnerability (USN-638-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2008-3533

critical

Tenable Plugins

critical

critical

critical

critical

critical