PT-2007-1877 · Gxine · Gxine

Published 2007-01-23 · Updated 2017-07-29 · CVE-2007-0406

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions gxine versions 0.5.9 and earlier

Description The issue is related to multiple buffer overflows in certain functions within gxine, specifically in the main function in client.c, and the server setup and server client connect functions in server.c. This can be exploited by local users via a long HOME environment variable, potentially leading to a denial of service (daemon crash) or privilege escalation.

Recommendations For gxine versions 0.5.9 and earlier, consider restricting the length of the HOME environment variable to prevent buffer overflows until a patch is available. As a temporary workaround, limiting the privileges of the gxine daemon may also help minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-0406

Affected Products

Gxine

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-0406 · Security Note
• http://osvdb.org/38320 · Note
• http://vupen.com/english/advisories/2007/0259 · Note
• http://xinehq.de/index.php/news?show_category_id=1 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31604 · Note
• http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=476891 · Note
• http://osvdb.org/38321 · Note