yanked from bugtraq (no link on securityfocus.com yet): Zone-h Security Advisory Date of discovery : 21 june 2004 Date of release : 24 june 2004 Bug found by Khan Shirani <shirani@zone-h.org> http://www.zone-h.org --------------------------------------- Software : GNU Gnats 4.00 Bugs : formats string bug(s) Risk : low/medium Platform : *nix --------------------------------------- Vulnerability: ============== A format string bug has been discovered in the Gnats package which could *possibly* be exploited to execute arbitrary commands. vulnerable code: ================ ---------------------- gnats-4.0\gnats\misc.c #ifdef HAVE_SYSLOG_H case SYSLOG: syslog (severity, buf); break; #endif ---------------------- Vendor Notice: ============== The Gnats team has been notified of the discoveries via <bug-gnats@gnu.org> No patch is available at this time Reproducible: Always Steps to Reproduce: 1. 2. 3.
The app-xemacs/gnats package we have in portage (an xemacs extension in Lisp, version 1.15) is not the same as the vulnerable GNU Gnats (written in C, version 4.0). So I don't think we are vulnerable. Krispy : please confirm and close as INVALID if you agree.
Whoops. Good catch.
