GLSA 200712-09: Ruby-GNOME2: Format string error

http://security.gentoo.org/

Severity:	normal
Title:	Ruby-GNOME2: Format string error
Date:	12/09/2007
Bugs:	#200623
ID:	200712-09

Synopsis

A format string error has been discovered in Ruby-GNOME2, possibly leading to the execution of arbitrary code.

Background

Ruby-GNOME2 is a set of bindings for using GTK+ within the Ruby programming language.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
dev-ruby/ruby-gtk2	< 0.16.0-r2	>= 0.16.0-r2	All supported architectures

Description

Chris Rohlf discovered that the "Gtk::MessageDialog.new()" method in the file gtk/src/rbgtkmessagedialog.c does not properly sanitize the "message" parameter before passing it to the gtk_message_dialog_new() function.

Impact

A remote attacker could send a specially crafted string to an application using Ruby-GNOME2, possibly leading to the execution of arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All Ruby-GNOME2 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-ruby/ruby-gtk2-0.16.0-r2"

References

CVE-2007-6183

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200712-09.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.