Bug 480641 (CVE-2008-5718)

Summary:

CVE-2008-5718 netatalk: papd command injection vulnerability

Product:

[Other] Security Response

Reporter:

Tomas Hoger <thoger>

Component:

vulnerability

Assignee:

Red Hat Product Security <security-response-team>

Status:

CLOSED ERRATA

QA Contact:

Severity:

medium

Docs Contact:

Priority:

medium

Version:

unspecified

CC:

jlieskov, jskala

Target Milestone:

---

Keywords:

Security

Target Release:

---

Hardware:

All

OS:

Linux

URL:

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5718

Whiteboard:

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2010-12-24 03:53:53 UTC

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Attachments:

Description	Flags
Debian patch	none

Description Tomas Hoger 2009-01-19 16:35:42 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5718 to the following vulnerability:

The papd daemon in Netatalk before 2.0.4-beta2 allows remote attackers to
execute arbitrary commands via shell metacharacters in a print request. NOTE:
some of these details are obtained from third party information.

References:
http://sourceforge.net/project/shownotes.php?release_id=648189
http://osvdb.org/50824
http://secunia.com/advisories/33227
http://www.debian.org/security/2009/dsa-1705

Further discussion about this flaw and the fix:
http://www.openwall.com/lists/oss-security/2009/01/13/3
http://sourceforge.net/mailarchive/forum.php?thread_name=20090109110344.GA24977%40suse.de&forum_name=netatalk-devel

Patch in the upstream CVS:
http://netatalk.cvs.sourceforge.net/viewvc/netatalk/netatalk/etc/papd/lp.c?r1=1.16&r2=1.17

Comment 1 Tomas Hoger 2009-01-19 16:37:02 UTC

Created attachment 329361 [details]
Debian patch

From DSA-1705-1 (http://www.debian.org/security/2009/dsa-1705), quotes few more special shell characters.

Comment 2 Jan Lieskovsky 2009-01-27 08:59:25 UTC

This issue affects all versions of the netatalk package, as shipped
with Fedora releases of 9, 10 and devel.

Please fix.

Comment 4 Tomas Hoger 2009-01-28 18:29:13 UTC

Extended bad characters blacklist as used in Debian patch was found incomplete as well:  http://www.openwall.com/lists/oss-security/2009/01/28/10

More complete blacklist is now committed in upstream CVS:
http://netatalk.cvs.sourceforge.net/viewvc/netatalk/netatalk/etc/papd/lp.c?r1=1.21&r2=1.22

Comment 5 Fedora Update System 2009-03-25 15:32:13 UTC

netatalk-2.0.3-23.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/netatalk-2.0.3-23.fc10

Comment 6 Fedora Update System 2009-03-25 15:32:18 UTC

netatalk-2.0.3-21.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/netatalk-2.0.3-21.fc9

Comment 7 Fedora Update System 2009-03-26 14:55:06 UTC

netatalk-2.0.3-21.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2009-03-26 14:55:48 UTC

netatalk-2.0.3-23.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.