Bug 185981

Summary:	CVE-2006-1296 beagle-status arbitrary script execution
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	beagle	Assignee:	Alexander Larsson <alexl>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	source=cve,reported=20060319,public=20060317,impact=moderate
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-03-22 10:47:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2006-03-20 17:31:27 UTC

A bug was found in the way the beagle-status script calls the
beagle-info script.  Please see the folling Debian bug for more
information:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=357392

This bug could allow a local attacker to execute arbitrary commands as
the user running beagle-status.

Comment 1 Fedora Update System 2006-03-21 16:29:38 UTC

beagle-0.2.3-4 has been pushed for FC5, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.