Bug 169668 (CVE-2005-0023) - CVE-2005-0023 gnome-pty-helper utmp/wtmp record spoofing
Summary: CVE-2005-0023 gnome-pty-helper utmp/wtmp record spoofing
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2005-0023
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: vte
Version: 4.0
Hardware: All
OS: Linux
medium
low
Target Milestone: ---
: ---
Assignee: Warren Togami
QA Contact:
URL:
Whiteboard: impact=low,source=debian,public=20050...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-09-30 20:32 UTC by Josh Bressers
Modified: 2012-12-14 17:29 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-10-26 14:20:59 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Josh Bressers 2005-09-30 20:32:01 UTC 
This was scavanged from the debian bug report:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=329156

gnome-pty-helper can be made to write utmp/wtmp records with arbitrary
DISPLAY (host) settings. I am not sure if it can be tricked into erasing
existing records.
Comment 1 Josh Bressers 2005-09-30 20:35:01 UTC 
This issue may also affect RHEL2.1 and RHEL3
Comment 3 Mark J. Cox 2005-10-26 14:20:59 UTC 
Security team review 20051026 decided this flaw is not a security risk -> WONTFIX
Note You need to log in before you can comment on or make changes to this bug.