GLSA-200810-01 : WordNet: Execution of arbitrary code

critical Nessus Plugin ID 34365

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200810-01 (WordNet: Execution of arbitrary code)

Jukka Ruohonen initially reported a boundary error within the searchwn() function in src/wn.c. A thorough investigation by the oCERT team revealed several other vulnerabilities in WordNet:
Jukka Ruohonen and Rob Holland (oCERT) reported multiple boundary errors within the searchwn() function in src/wn.c, the wngrep() function in lib/search.c, the morphstr() and morphword() functions in lib/morph.c, and the getindex() in lib/search.c, which lead to stack-based buffer overflows.
Rob Holland (oCERT) reported two boundary errors within the do_init() function in lib/morph.c, which lead to stack-based buffer overflows via specially crafted 'WNSEARCHDIR' or 'WNHOME' environment variables.
Rob Holland (oCERT) reported multiple boundary errors in the bin_search() and bin_search_key() functions in binsrch.c, which lead to stack-based buffer overflows via specially crafted data files.
Rob Holland (oCERT) reported a boundary error within the parse_index() function in lib/search.c, which leads to a heap-based buffer overflow via specially crafted data files.
Impact :

In case the application is accessible e.g. via a web server, a remote attacker could pass overly long strings as arguments to the 'wm' binary, possibly leading to the execution of arbitrary code.
A local attacker could exploit the second vulnerability via specially crafted 'WNSEARCHDIR' or 'WNHOME' environment variables, possibly leading to the execution of arbitrary code with escalated privileges.
A local attacker could exploit the third and fourth vulnerability by making the application use specially crafted data files, possibly leading to the execution of arbitrary code.
Workaround :

There is no known workaround at this time.

Solution

All WordNet users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=app-dicts/wordnet-3.0-r2'

Plugin Details

Severity: Critical

ID: 34365

File Name: gentoo_GLSA-200810-01.nasl

Version: 1.15

Type: local

Family: Gentoo Local Security Checks

Published: 10/8/2008

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/o:gentoo:linux, p-cpe:/a:gentoo:linux:wordnet

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Patch Publication Date: 10/7/2008

Reference Information

CVE: CVE-2008-2149, CVE-2008-3908

CWE: 119

GLSA: 200810-01

Detections

Analytics