CVE-1999-1477

Vulnerability

A buffer overflow vulnerability exists in GNOME's shared libraries when handling the --espeaker command-line argument. This issue affects GNOME libraries version 1.0.8 and potentially the esound library version 0.2.8. Local users can trigger this overflow by calling programs linked against these libraries with a long --espeaker argument, such as in setuid root programs like /usr/games/nethack [1].

Exploitation

An attacker needs local access to the system and must be able to execute a program linked against the vulnerable GNOME libraries. The attacker can exploit this by invoking a target program, such as /usr/games/nethack, with a specially crafted command-line argument that includes --espeaker= followed by an oversized buffer. This crafted argument will overwrite memory, potentially allowing the execution of arbitrary code [1].

Impact

Successful exploitation of this buffer overflow allows a local user to gain root privileges. This is achieved by attacking setuid binaries that are linked against the vulnerable GNOME libraries. The attacker can execute arbitrary code with the privileges of the setuid binary, which in this case is root [1].

Mitigation

This vulnerability was addressed in later versions of GNOME libraries. While a specific fixed version and release date are not provided in the available references, updating to a non-vulnerable version of the GNOME libraries or esound is the recommended mitigation. No workarounds are described in the provided references, and the vulnerability is not listed as actively exploited in the wild [1].