reported via email@example.com:
The graphical sealert program interprets records in the setroubleshoot
database as HTML when it displays them to the user. These records
include arbitrary attacker-controlled values such as the names of
processes and files involved in AVC denial events, and the sealert
daemon fails to properly escape those values before passing them to its
HTML parser. This allows an unprivileged local attacker to inject
arbitrary HTML tags into the alerts displayed by the sealert browser,
altering an alert's appearance or inserting arbitrary links. There is no
preview bar to show a link's target URL. When a link in the alert is
clicked, the program executes the following Python code, where 'arg2' is
the value of the link's href attribute:
os.spawnl(os.P_NOWAIT, "/usr/bin/htmlview", "htmlview", arg2)
The htmlview script executes the user's preferred web browser, which
defaults to /usr/bin/firefox under RHEL 5. Since the attacker controls
only one argument, it does not appear to be possible to inject arbitrary
chrome:/// context. However, in combination with security flaws in
Firefox or any other web browser that htmlview may launch, this flaw
could be used to execute arbitrary code or steal credentials.
This is a valid flaw. The HTML is generated from templates with instance
specific values from the AVC substituted into the template. The data inserted
into the template should have their HTML entities escaped prior to template
This is an easy fix and the RHEL version could be easily patched. The flaw is
present in all current versions.
John, is setroubleshoot 2.0 first version to include a fix for this issue?
Is this the only relevant upstream commit?
Yes, version 2.0 was the first public version to contain these fixes.
This issue was addressed in:
Red Hat Enterprise Linux: