Bug 448285 - (CVE-2008-2575) CVE-2008-2575 cbrpager: Command executions via improper shell escaping
CVE-2008-2575 cbrpager: Command executions via improper shell escaping
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
source=fedora,reported=20080522,publi...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-05-25 09:13 EDT by Tomas Hoger
Modified: 2008-06-07 13:32 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-06-07 13:32:07 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2008-05-25 09:13:09 EDT
Mamoru Tasaka discovered, that cbrpager (Simple comic book pager for Linux) does
not properly sanitize file names of the image archives before calling external
decompression utilities unrar and unzip using system() libc library call. 
Opening a .zip or .rar archive with specially crafted filename can result in an
execution of the arbitrary code with the privileges of the user running cbrpager.

Sample file name:
  test";echo owned>bla;".rar
(same as for similar issue in comix -
https://bugzilla.redhat.com/show_bug.cgi?id=430635#c4)

Mamoru's patch accepted by upstream:
http://cvs.fedoraproject.org/viewcvs/rpms/cbrpager/devel/cbrpager-0.9.16-filen-shell-escaping.patch?rev=1.2

Fixed upstream in version 0.9.17:
http://sourceforge.net/forum/forum.php?forum_id=827120
http://www.jcoppens.com/soft/cbrpager/log.en.php
Comment 1 Mamoru TASAKA 2008-05-25 15:44:19 EDT
Non-security issue is found on 0.9.17-1.fc{10-7}, so updating
to 0.9.17-2.fc{10-7} and editting updates requests.
Comment 2 Fedora Update System 2008-05-28 22:38:31 EDT
cbrpager-0.9.17-2.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2008-05-28 22:42:22 EDT
cbrpager-0.9.17-2.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2008-05-28 22:43:56 EDT
cbrpager-0.9.17-2.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Mamoru TASAKA 2008-05-30 13:19:02 EDT
Upstream released 0.9.18. With this version the following patch
is applied
http://cvs.fedoraproject.org/viewcvs/*checkout*/rpms/cbrpager/devel/cbrpager-0.9.17-zip-filen-escape.patch?hideattic=0&rev=1.1

cbrpager-0.9.18-1.fc{9,8,7} are now in request queue to stable on bodhi
Comment 6 Tomas Hoger 2008-06-07 13:27:01 EDT
CVE id CVE-2008-2575 was assigned to this issue:

cbrPager before 0.9.17 allows user-assisted remote attackers to
execute arbitrary commands via shell metacharacters in a (1) ZIP (aka
.cbz) or (2) RAR (aka .cbr) archive filename.

Note You need to log in before you can comment on or make changes to this bug.