Format string vulnerability in gedit 2.10.2 may allow attackers to cause a denial of service (application crash) via a bin file with format string specifiers in the filename. NOTE: while this issue is triggered on the command line by the gedit user, it has been reported that web browsers and email clients could be configured to provide a file name as an argument to gedit, so there is a valid attack that crosses security boundaries.

SunOS 5.10_x86: Gedit patch.
Date this patch was last updated by Sun : May/04/10

GNOME 2.6.0_x86: Gnome text editor Patch.
Date this patch was last updated by Sun : Jun/04/10

SunOS 5.10: Gedit patch.
Date this patch was last updated by Sun : May/04/10

GNOME 2.6.0: Gnome text editor Patch.
Date this patch was last updated by Sun : Jun/04/10

This advisory adds security support for the stable amd64 distribution.
It covers all security updates since the release of sarge, which were missing updated packages for the not yet official amd64 port. Future security advisories will include updates for this port as well.

Gedit had a format string bug in the filename handling, potentially allowing an attacker to execute arbitrary code. This bug has been fixed. (CVE-2005-1686)

An updated gedit package that fixes a file name format string vulnerability is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team

gEdit is a small text editor designed specifically for the GNOME GUI desktop.

A file name format string vulnerability has been discovered in gEdit.
It is possible for an attacker to create a file with a carefully crafted name which, when the file is opened, executes arbitrary instructions on a victim's machine. Although it is unlikely that a user would manually open a file with such a carefully crafted file name, a user could, for example, be tricked into opening such a file from within an email client. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1686 to this issue.

Users of gEdit should upgrade to this updated package, which contains a backported patch to correct this issue.

Yan Feng reports a format string vulnerability in gedit. This vulnerability could cause a denial of service with a binary file that contains format string characters within the filename. It had been reported that web browsers and email clients can be configured to provide a filename as an argument to gedit.:

A format string vulnerability has been discovered in gedit. Calling the program with specially crafted file names caused a buffer overflow, which could be exploited to execute arbitrary code with the privileges of the gedit user.

This becomes security relevant if e. g. your web browser is configued to open URLs in gedit. If you never open untrusted file names or URLs in gedit, this flaw does not affect you.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A format string vulnerability has been discovered in gedit, a light-weight text editor for GNOME, that may allow attackers to cause a denial of service (application crash) via a binary file with format string specifiers in the filename. Since gedit supports opening files via 'http://' URLs (through GNOME vfs) and other schemes, this might be a remotely exploitable vulnerability.

The old stable distribution (woody) is not vulnerable to this problem.

A vulnerability was discovered in gEdit where it was possible for an attacker to create a file with a carefully crafted name which, when opened, executed arbitrary code on the victim's computer. It is highly unlikely that a user would open such a file, due to the file name, but could possibly be tricked into opening it.

The updated packages have been patched to correct this problem.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:499 advisory.

  - security flaw (CVE-2005-1686)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200506-09 (gedit: Format string vulnerability)

    A format string vulnerability exists when opening files with names     containing format specifiers.
  Impact :

    A specially crafted file with format specifiers in the filename can     cause arbitrary code execution.
  Workaround :

    There are no known workarounds at this time.

ID	Name	Product	Family	Severity
108056	Solaris 10 (x86) : 143740-01	Nessus	Solaris Local Security Checks	low
107862	Solaris 10 (x86) : 120287-03	Nessus	Solaris Local Security Checks	low
107562	Solaris 10 (sparc) : 143739-01	Nessus	Solaris Local Security Checks	low
107360	Solaris 10 (sparc) : 120286-03	Nessus	Solaris Local Security Checks	low
57528	Debian DSA-773-1 : amd64 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
41075	SuSE9 Security Update : gedit (YOU Patch Number 10253)	Nessus	SuSE Local Security Checks	low
21832	CentOS 3 / 4 : gedit (CESA-2005:499)	Nessus	CentOS Local Security Checks	low
21524	FreeBSD : gedit -- format string vulnerability (e319da0b-a228-11da-b410-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	low
20530	Ubuntu 4.10 / 5.04 : gedit vulnerability (USN-138-1)	Nessus	Ubuntu Local Security Checks	low
18674	Debian DSA-753-1 : gedit - format string	Nessus	Debian Local Security Checks	low
18499	Mandrake Linux Security Advisory : gedit (MDKSA-2005:102)	Nessus	Mandriva Local Security Checks	low
18473	RHEL 4 : gedit (RHSA-2005:499)	Nessus	Red Hat Local Security Checks	medium
18466	GLSA-200506-09 : gedit: Format string vulnerability	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2005-1686

medium

Tenable Plugins

low

low

low

low

critical

low

low

low

low

low

low

medium

low