reported via secalert: The graphical sealert program interprets records in the setroubleshoot database as HTML when it displays them to the user. These records include arbitrary attacker-controlled values such as the names of processes and files involved in AVC denial events, and the sealert daemon fails to properly escape those values before passing them to its HTML parser. This allows an unprivileged local attacker to inject arbitrary HTML tags into the alerts displayed by the sealert browser, altering an alert's appearance or inserting arbitrary links. There is no preview bar to show a link's target URL. When a link in the alert is clicked, the program executes the following Python code, where 'arg2' is the value of the link's href attribute: os.spawnl(os.P_NOWAIT, "/usr/bin/htmlview", "htmlview", arg2) The htmlview script executes the user's preferred web browser, which defaults to /usr/bin/firefox under RHEL 5. Since the attacker controls only one argument, it does not appear to be possible to inject arbitrary shell commands, or to cause Firefox to execute arbitrary JavaScript in chrome:/// context. However, in combination with security flaws in Firefox or any other web browser that htmlview may launch, this flaw could be used to execute arbitrary code or steal credentials.
This is a valid flaw. The HTML is generated from templates with instance specific values from the AVC substituted into the template. The data inserted into the template should have their HTML entities escaped prior to template substitution. This is an easy fix and the RHEL version could be easily patched. The flaw is present in all current versions.
removing embargo
John, is setroubleshoot 2.0 first version to include a fix for this issue? Is this the only relevant upstream commit? https://hosted.fedoraproject.org/setroubleshoot/changeset/956:72c554eb9543
Yes, version 2.0 was the first public version to contain these fixes.
This issue was addressed in: Red Hat Enterprise Linux: http://rhn.redhat.com/errata/RHSA-2008-0061.html