gdb before 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running gdb.

An update of the crash package has been released.

An updated gdb package that fixes several bugs and minor security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GDB, the GNU debugger, allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion, then printing their data.

Several integer overflow bugs were found in gdb. If a user is tricked into processing a specially crafted executable file, it may allow the execution of arbitrary code as the user running gdb. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1704 to this issue.

A bug was found in the way gdb loads .gdbinit files. When a user executes gdb, the local directory is searched for a .gdbinit file which is then loaded. It is possible for a local user to execute arbitrary commands as the victim running gdb by placing a malicious .gdbinit file in a location where gdb may be run. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1705 to this issue.

This updated package also addresses the following issues :

  - GDB on ia64 had previously implemented a bug fix to     work-around a kernel problem when creating a core file     via gcore. The bug fix caused a significant slow-down of     gcore.

  - GDB on ia64 issued an extraneous warning when gcore was     used.

  - GDB on ia64 could not backtrace over a sigaltstack.

  - GDB on ia64 could not successfully do an info frame for     a signal trampoline.

  - GDB on AMD64 and Intel EM64T had problems attaching to a     32-bit process.

  - GDB on AMD64 and Intel EM64T was not properly handling     threaded watchpoints.

  - GDB could not build with gcc4 when -Werror flag was set.

  - GDB had problems printing inherited members of C++     classes.

  - A few updates from mainline sources concerning Dwarf2     partial die in cache support, follow-fork support,     interrupted syscall support, and DW_OP_piece read     support.

All users of gdb should upgrade to this updated package, which resolves these issues.

Tavis Ormandy found an integer overflow in the GNU debugger. By tricking an user into merely load a specially crafted executable, an attacker could exploit this to execute arbitrary code with the privileges of the user running gdb. However, loading untrusted binaries without actually executing them is rather uncommon, so the risk of this flaw is low. (CAN-2005-1704)

Tavis Ormandy also discovered that gdb loads and executes the file '.gdbinit' in the current directory even if the file belongs to a different user. By tricking an user into run gdb in a directory with a malicious .gdbinit file, a local attacker could exploit this to run arbitrary commands with the privileges of the user invoking gdb.
(CAN-2005-1705).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated gdb package that fixes minor security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GDB, the GNU debugger, allows debugging of programs written in C, C++, and other languages by executing them in a controlled fashion, then printing their data.

Several integer overflow bugs were found in gdb. If a user is tricked into processing a specially crafted executable file, it may allow the execution of arbitrary code as the user running gdb. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1704 to this issue.

A bug was found in the way gdb loads .gdbinit files. When a user executes gdb, the local directory is searched for a .gdbinit file which is then loaded. It is possible for a local user to execute arbitrary commands as the user running gdb by placing a malicious .gdbinit file in a location where gdb may be run. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1705 to this issue.

All users of gdb should upgrade to this updated package, which contains backported patches that resolve these issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:709 advisory.

    GDB, the GNU debugger, allows debugging of programs written in C, C++,     and other languages by executing them in a controlled fashion, then     printing their data.

    Several integer overflow bugs were found in gdb. If a user is tricked     into processing a specially crafted executable file, it may allow the     execution of arbitrary code as the user running gdb. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2005-1704 to this issue.

    A bug was found in the way gdb loads .gdbinit files. When a user executes     gdb, the local directory is searched for a .gdbinit file which is then     loaded. It is possible for a local user to execute arbitrary commands as     the victim running gdb by placing a malicious .gdbinit file in a location     where gdb may be run. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-1705 to this issue.

    This updated package also addresses the following issues:

    - GDB on ia64 had previously implemented a bug fix to work-around a kernel     problem when creating a core file via gcore.  The bug fix caused a     significant slow-down of gcore.

    - GDB on ia64 issued an extraneous warning when gcore was used.

    - GDB on ia64 could not backtrace over a sigaltstack.

    - GDB on ia64 could not successfully do an info frame for a signal trampoline.

    - GDB on AMD64 and Intel EM64T had problems attaching to a 32-bit process.

    - GDB on AMD64 and Intel EM64T was not properly handling threaded watchpoints.

    - GDB could not build with gcc4 when -Werror flag was set.

    - GDB had problems printing inherited members of C++ classes.

    - A few updates from mainline sources concerning Dwarf2 partial die in     cache support, follow-fork support, interrupted syscall support, and     DW_OP_piece read support.

    All users of gdb should upgrade to this updated package, which resolves     these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Tavis Ormandy of the Gentoo Linux Security Audit Team discovered two vulnerabilities in the GNU debugger. The first allows an attacker to execute arbitrary code with the privileges of the user running gdb if they can trick the user into loading a specially crafted executable (CVE-2005-1704).

He also discovered that gdb loads and executes the file .gdbinit in the current directory even if the file belongs to a different user. If a user can be tricked into running gdb in a directory with a malicious .gdbinit file, a local attacker can exploit this to run arbitrary commands with the privileges of the user running gdb (CVE-2005-1705).

The updated packages have been patched to correct these problems.

The remote host is affected by the vulnerability described in GLSA-200505-15 (gdb: Multiple vulnerabilities)

    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered an     integer overflow in the BFD library, resulting in a heap overflow. A     review also showed that by default, gdb insecurely sources     initialisation files from the working directory.
  Impact :

    Successful exploitation would result in the execution of arbitrary code     on loading a specially crafted object file or the execution of     arbitrary commands.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	critical
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	critical
67033	CentOS 4 : gdb (CESA-2005:709)	Nessus	CentOS Local Security Checks	high
20526	Ubuntu 4.10 / 5.04 : gdb vulnerabilities (USN-135-1)	Nessus	Ubuntu Local Security Checks	high
20059	RHEL 2.1 : gdb (RHSA-2005:801)	Nessus	Red Hat Local Security Checks	high
19994	RHEL 4 : gdb (RHSA-2005:709)	Nessus	Red Hat Local Security Checks	high
18404	Mandrake Linux Security Advisory : gdb (MDKSA-2005:095)	Nessus	Mandriva Local Security Checks	high
18379	GLSA-200505-15 : gdb: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-1705

high

Tenable Plugins

critical

critical

high

high

high

high

high

high