Bug 1040266 - (CVE-2013-7050) CVE-2013-7050 devscripts: code execution flaw in uscan
CVE-2013-7050 devscripts: code execution flaw in uscan
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 1040267
  Show dependency treegraph
Reported: 2013-12-10 23:28 EST by Murray McAllister
Modified: 2015-03-19 18:04 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2015-03-19 18:04:47 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Murray McAllister 2013-12-10 23:28:35 EST
A flaw was reported in the uscan script of devscripts:


From that bug report:

The newfangled debian/copyright-driven repacking can be exploited by
malicious upstream to execute arbitrary code.

The fix:


devscripts is not included in Fedora 18 or 19. It looks to be part of rawhide/the upcoming Fedora 20.

Although some Debian stuff is bundled in the rpmdevtools package, uscan does not appear to be.
Comment 1 Murray McAllister 2013-12-10 23:30:37 EST
Created devscripts tracking bugs for this issue:

Affects: fedora-rawhide [bug 1040267]
Comment 2 Murray McAllister 2013-12-10 23:34:37 EST
CVE request: http://www.openwall.com/lists/oss-security/2013/12/11/1
Comment 3 Vincent Danen 2013-12-13 13:16:02 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-7050 to
the following vulnerability:

Name: CVE-2013-7050
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7050
Assigned: 20131211
Reference: http://seclists.org/oss-sec/2013/q4/470
Reference: http://seclists.org/oss-sec/2013/q4/486
Reference: http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git;a=commitdiff;h=91f05b5
Reference: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849
Reference: http://www.securityfocus.com/bid/64241

The get_main_source_dir function in scripts/uscan.pl in devscripts
before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to
execute arbitrary commands via shell metacharacters in a directory
Comment 4 Fedora Update System 2013-12-20 21:17:19 EST
devscripts-2.13.5-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.