Bug 448285 (CVE-2008-2575) - CVE-2008-2575 cbrpager: Command executions via improper shell escaping
Summary: CVE-2008-2575 cbrpager: Command executions via improper shell escaping
Status: CLOSED ERRATA
Alias: CVE-2008-2575
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: source=fedora,reported=20080522,publi...
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-05-25 13:13 UTC by Tomas Hoger
Modified: 2008-06-07 17:32 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-06-07 17:32:07 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Tomas Hoger 2008-05-25 13:13:09 UTC
Mamoru Tasaka discovered, that cbrpager (Simple comic book pager for Linux) does
not properly sanitize file names of the image archives before calling external
decompression utilities unrar and unzip using system() libc library call. 
Opening a .zip or .rar archive with specially crafted filename can result in an
execution of the arbitrary code with the privileges of the user running cbrpager.

Sample file name:
  test";echo owned>bla;".rar
(same as for similar issue in comix -
https://bugzilla.redhat.com/show_bug.cgi?id=430635#c4)

Mamoru's patch accepted by upstream:
http://cvs.fedoraproject.org/viewcvs/rpms/cbrpager/devel/cbrpager-0.9.16-filen-shell-escaping.patch?rev=1.2

Fixed upstream in version 0.9.17:
http://sourceforge.net/forum/forum.php?forum_id=827120
http://www.jcoppens.com/soft/cbrpager/log.en.php

Comment 1 Mamoru TASAKA 2008-05-25 19:44:19 UTC
Non-security issue is found on 0.9.17-1.fc{10-7}, so updating
to 0.9.17-2.fc{10-7} and editting updates requests.

Comment 2 Fedora Update System 2008-05-29 02:38:31 UTC
cbrpager-0.9.17-2.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2008-05-29 02:42:22 UTC
cbrpager-0.9.17-2.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2008-05-29 02:43:56 UTC
cbrpager-0.9.17-2.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Mamoru TASAKA 2008-05-30 17:19:02 UTC
Upstream released 0.9.18. With this version the following patch
is applied
http://cvs.fedoraproject.org/viewcvs/*checkout*/rpms/cbrpager/devel/cbrpager-0.9.17-zip-filen-escape.patch?hideattic=0&rev=1.1

cbrpager-0.9.18-1.fc{9,8,7} are now in request queue to stable on bodhi

Comment 6 Tomas Hoger 2008-06-07 17:27:01 UTC
CVE id CVE-2008-2575 was assigned to this issue:

cbrPager before 0.9.17 allows user-assisted remote attackers to
execute arbitrary commands via shell metacharacters in a (1) ZIP (aka
.cbz) or (2) RAR (aka .cbr) archive filename.


Note You need to log in before you can comment on or make changes to this bug.