PT-2010-1148 · Gnustep · Gnustep-Base

Dan Rosenberg + 1 · Published 2010-05-12 · Updated 2014-01-20 · CVE-2010-1620

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNUstep Base versions prior to 1.20.0 GNUstep Base versions prior to 1.20.1

Description The issue is related to an integer overflow in the load iface function in Tools/gdomap.c in gdomap, which might allow attackers to execute arbitrary code via a file or socket that provides configuration data with many entries, leading to a heap-based buffer overflow. Additionally, there are multiple vulnerabilities in the gnustep-base package that can lead to violations of confidentiality, integrity, and availability of protected information, and these can be exploited locally.

Recommendations For versions prior to 1.20.0, update to version 1.20.0 or later. For versions prior to 1.20.1, update to version 1.20.1 or later. As a temporary workaround, consider restricting access to the load iface function in Tools/gdomap.c until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-189

Related Identifiers

BDU:2015-09691

CVE-2010-1620

Affected Products

Gnustep-Base

References · 16

• 🔥 https://bugs.launchpad.net/ubuntu/+source/gnustep-base/+bug/573108 · Exploit
• 🔥 http://thread.gmane.org/gmane.comp.lib.gnustep.bugs/12336 · Exploit
• https://osv.dev/vulnerability/CVE-2010-1620 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09691 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-1620 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-1620 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1620 · Vendor Advisory
• http://secunia.com/advisories/39746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1620 · Security Note
• https://ubuntu.com/security/CVE-2010-1620 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2010-1620 · Security Note
• http://ftpmain.gnustep.org/pub/gnustep/core/gnustep-base-1.20.0.tar.gz · Patch
• http://marc.info/?l=oss-security&m=127324274005709&w=2 · Note
• http://marc.info/?l=oss-security&m=127325778527537&w=2 · Note
• http://security.gentoo.org/glsa/glsa-201401-12.xml · Note