Kevin Finisterre has reported some vulnerabilities in Ce/Ceterm, which potentially can be exploited by malicious, local users to gain escalated privileges.

1) A boundary error in the processing of the "XAPPLRESLANGPATH" and "XAPPLRESDIR" environment variables can be exploited to cause a buffer overflow via an overly long environment variable.

Successful exploitation allows execution of arbitrary code with root privileges, if the application has been installed setuid root.

2) A boundary error in the processing of command line arguments can be exploited to cause a buffer overflow by supplying an overly long argument.

Successful exploitation allows execution of arbitrary code with root privileges, if the application has been installed setuid root.

3) The temporary file "ce_edit_log" is created insecurely, which can be exploited via symlink attacks to overwrite arbitrary files with the privileges of the user running the application.

Solution
Remove the setuid bit from "ce". This may affect the functionality in older versions on some systems.
Further details available in Customer Area

Provided and/or discovered by
Kevin Finisterre

Changelog
Further details available in Customer Area

Original Advisory
http://www.digitalmunition.com/DMA[2005-0501a].txt

Deep Links
Links available in Customer Area