Security Advisory SA45815 - GTK+ Insecure Library Loading Vulnerability

Secunia

Blog

Secunia Advisory SA45815

GTK+ Insecure Library Loading Vulnerability

Secunia Advisory

SA45815

Release Date

2011-09-05

Last Update

2011-09-22

Popularity

6,360 views

Comments

2 comments

Criticality level

Highly critical

Impact

System access

Where

From remote

Authentication level

This information is available to Secunia VIM customers

Report reliability

This information is available to Secunia VIM customers

Solution Status

Vendor Patch

Systems affected

This information is available to Secunia VIM customers

Approve distribution

This information is available to Secunia VIM customers

Remediation status

Secunia CSI, Secunia PSI

Automated scanning

Secunia CSI, Secunia PSI

Software:

GTK+ 2.x

Secunia CVSS Score

This information is available to Secunia VIM Customers

CVE Reference(s)

CVE-2010-4831 CVSS score available to Secunia VIM customers

Description

Naoto Katsumi has reported a vulnerability in GTK+, which can be exploited by malicious people to compromise an application using the library.

The vulnerability is caused due to the "_gdk_input_wintab_init_check()" (gdk/win32/gdkinput-win32.c) and the "xp_theme_init()" functions (modules/engines/ms-windows/xp_theme.c) loading libraries (wintab32.dll and uxtheme.dll) in an insecure manner. This can be exploited to load arbitrary libraries when an application using this library e.g. opens a file located on a remote WebDAV or SMB share.

Successful exploitation may allow execution of arbitrary code.

Solution
Update to version 2.24.0.

Provided and/or discovered by
Naoto Katsumi, LAC Co., Ltd.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Naoto Katsumi:
http://www.lac.co.jp/info/advisory/108.html

JVN:
http://jvn.jp/en/jp/JVN58019849/index.html

GTK+:
http://git.gnome.org/browse/gtk+/commit/modules/engines/ms-windows/xp_theme.c?h=gtk-2-24&id=d6e11a97e318158f5d210a0476870dfe14ed95e6
http://git.gnome.org/browse/gtk+/commit/gdk/win32/gdkinput-win32.c?h=gtk-2-24&id=88f54ea47d4a55bbbf9e34a7a0502f365eb69ae5&ss=1

Deep Links
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: GTK+ Insecure Library Loading Vulnerability

User

Message

earthsound

RE: GTK+ Insecure Library Loading Vulnerability

16th Sep, 2011 18:19

Score: -9
Posts: 13
User Since: 10th Dec 2008
System Score: N/A
Location: Hoover, AL, US
Last edited on 16th Sep, 2011 18:19

According to the advisory, versions prior to 2.21.8 are affected. I had 2.22 installed, but secunia reported it as being vulnerable.

Was this reply relevant?

-0

ddmarshall

RE: GTK+ Insecure Library Loading Vulnerability

16th Sep, 2011 19:01

Score: 1126
Posts: 910
User Since: 8th Nov 2008
System Score: 100%
Location: UK

According to this, versions prior to 2.24.0 are vulnerable.
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CV...

The Secunia recommendation to upgrade to 2.24 appears to be correct.

--
This answer is provided “as-is.” You bear the risk of using it.

Was this reply relevant?

-0

Secunia Advisory SA45815

GTK+ Insecure Library Loading Vulnerability

Do you have additional information related to this advisory?

You must be logged in to post a comment.

Secunia Customer Login

Not a customer already?