Bug 433723 (CVE-2008-0932)

Summary:	CVE-2008-0932 sword: diatheke.pl command injection
Product:	[Other] Security Response	Reporter:	Lubomir Kundrak <lkundrak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	dakingun
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://secunia.com/advisories/29012/
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-04-24 11:46:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	433724, 433725, 433726
Bug Blocks:

Description Lubomir Kundrak 2008-02-21 01:00:46 UTC

Description of problem:

The Diatheke CGI allows arbitrary command execution in the context of 
the webserver, e.g. www-data by simply abusing the range parameter.

For example, &range=`yes` will consume tons of resources on the affected 
webserver. Escalation of privleges and command shells are left as an 
exercise to the reader.

From Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466449

Comment 2 Lubomir Kundrak 2008-02-21 01:04:58 UTC

Gentoo, patch: dhttp://bugs.gentoo.org/show_bug.cgi?id=210754

Comment 3 Fedora Update System 2008-02-21 14:05:03 UTC

sword-1.5.10-2.fc7 has been submitted as an update for Fedora 7

Comment 4 Fedora Update System 2008-02-21 14:06:10 UTC

sword-1.5.10-2.fc8 has been submitted as an update for Fedora 8

Comment 5 Fedora Update System 2008-02-26 00:22:14 UTC

sword-1.5.10-2.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2008-02-26 00:24:47 UTC

sword-1.5.10-2.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Tomas Hoger 2008-02-26 08:07:57 UTC

Do Fedora sword packages really need this patch?  I fail to see diatheke.pl in
any of the sword non-source RPMs...

Comment 8 Tomas Hoger 2008-04-24 11:46:48 UTC

Fedora packages were updated, however, we do not seem to ship affected script. 
Closing as notabug.