W3M Browser InputAnswer Format String Vulnerability

TITLE: W3M Browser InputAnswer Format String Vulnerability
CLASS: Input Validation Error
CVE:
REMOTE: Yes
LOCAL: No
PUBLISHED: Jun 05 2007 12:00AM
UPDATE: Jun 06 2007 05:20PM
CREDIT: The vendor disclosed this issue.
VULNERABLE:

W3M W3M 0.5.1
W3M W3M 0.3.2 .2
W3M W3M 0.3.2 .1
W3M W3M 0.3.2
W3M W3M 0.3.1
+ RedHat Linux 8.0 i386
+ RedHat Linux 8.0
W3M W3M 0.3
+ RedHat Linux 7.3 i386
+ RedHat Linux 7.3
W3M W3M 0.2.5 .1
W3M W3M 0.2.5
W3M W3M 0.2.4
W3M W3M 0.2.3
W3M W3M 0.2.2
W3M W3M 0.2.1
+ Conectiva Linux 7.0
+ RedHat Linux 7.2 ia64
+ RedHat Linux 7.2 i386
+ RedHat Linux 7.2
W3M W3M 0.2
+ RedHat Linux 7.0 i386
+ RedHat Linux 7.0
W3M W3M 0.1.10
+ Conectiva Linux 6.0
W3M W3M 0.1.9
+ Conectiva Linux 5.1
+ Conectiva Linux 5.0
W3M W3M 0.1.8
W3M W3M 0.1.7
W3M W3M 0.1.6
W3M W3M 0.1.4
W3M W3M 0.1.3
NOT VULNERABLE:
W3M W3M 0.5.2

Vai alla pagina originale su Security Focus

Discussion

W3M is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

An attack can exploit this issue to execute arbitrary machine code in the context of the user running the affected browser. A successful attack will compromise the application. Failed attempts may cause denial-of-service conditions.

Versions prior to W3M 0.5.2 are vulnerable.

Exploit

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:vuldb@securityfocus.com.

Solution

Solution:
The vendor has released version 0.5.2 which addresses this issue. Please see the references section for further information.


W3M W3M 0.1.10


W3M W3M 0.1.3

W3M W3M 0.1.4

W3M W3M 0.1.6

W3M W3M 0.1.7

W3M W3M 0.1.8

W3M W3M 0.1.9

W3M W3M 0.2

W3M W3M 0.2.1

W3M W3M 0.2.2

W3M W3M 0.2.3

W3M W3M 0.2.4

W3M W3M 0.2.5 .1

W3M W3M 0.2.5

W3M W3M 0.3

W3M W3M 0.3.1

W3M W3M 0.3.2 .1

W3M W3M 0.3.2

W3M W3M 0.3.2 .2

W3M W3M 0.5.1

References

References:

PhpLog

BNLug Benevento Linux Users Group