CVE-2003-1167

Local attackers can exploit this vulnerability by modifying the PATH environment variable before executing KPopup. KPopup, installed setuid root, uses the system() function to call killall. By prepending a directory containing a malicious executable named 'killall' to the PATH, an attacker can cause their malicious program to be executed with root privileges. The exploit code demonstrates creating a malicious /tmp/killall script that compiles and executes a root shell [ref_id=1].

The vulnerability exists in misc.cpp within KPopup version 0.9.1. Specifically, the application uses the system() C-library function to invoke the killall binary in a manner that relies on the PATH environment variable [ref_id=1].

The advisory does not specify a patch or provide details on how the vulnerability is fixed. However, it is recommended to upgrade to a non-vulnerable version of KPopup. The general remediation for this type of vulnerability involves ensuring that setuid programs do not rely on user-controlled environment variables like PATH for executing commands, or by using absolute paths to known-good binaries.

The provided exploit code demonstrates how to reproduce the vulnerability by creating a malicious killall executable in /tmp and then triggering KPopup to execute it, ultimately leading to a root shell [ref_id=1].