stardict broadcasts clipboard context over network

2009-07-05 / 2009-07-06
Credit: Pavel Machek
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-200


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

Subject: stardict broadcasts clipboard context over network Package: stardict Version: 3.0.1-4.1 Justification: user security hole Severity: grave Tags: security *** Please type your report below this line *** In default config "enable net dict" is selected, it attempts to grab clipboard and sends it over network... Unfortunately, not nearly all data in clipboard are meant for translation, and some may be pretty sensitive. -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Kernel: Linux 2.6.30 (SMP w/2 CPU cores) Locale: LANG=C, LC_CTYPE=cs_CZ (charmap=ISO-8859-2) Shell: /bin/sh linked to /bin/bash Versions of packages stardict depends on: ii stardict-gnome 3.0.1-4.1 International dictionary for GNOME stardict recommends no packages. stardict suggests no packages. -- no debconf information -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

References:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top