Bug 1048699 (CVE-2013-6888, CVE-2013-7325) - CVE-2013-6888 CVE-2013-7325 devscripts: arbitrary code execution in uscan
Summary: CVE-2013-6888 CVE-2013-7325 devscripts: arbitrary code execution in uscan
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2013-6888, CVE-2013-7325
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1048700
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-01-06 07:28 UTC by Ratul Gupta
Modified: 2019-09-29 13:11 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-01-06 12:02:53 UTC


Attachments (Terms of Use)

Description Ratul Gupta 2014-01-06 07:28:00 UTC
A flaw was reported in the uscan script of devscripts:
http://www.debian.org/security/2014/dsa-2836

From the bug report:

An attacker controlling a website from which uscan would attempt to download a source tarball could execute arbitrary code with the privileges of the user running uscan.

Comment 1 Ratul Gupta 2014-01-06 07:28:40 UTC
Created devscripts tracking bugs for this issue:

Affects: fedora-20 [bug 1048700]

Comment 2 Sandro Mani 2014-01-06 12:02:53 UTC
From [1]: "[...] these problems have been fixed in version 2.13.9". F20+ ships devscripts-2.13.9. Closing bug.

[1] http://www.debian.org/security/2014/dsa-2836

Comment 3 Vincent Danen 2014-01-06 19:41:50 UTC
While true, you closed with an incorrect status.

Also, a better reference is this note in the debian/changelog file (since we cannot know whether the advisory noted above is a patched 2.13.9 or not):

devscripts (2.13.9) unstable; urgency=low

...

  [ James McCoy ]
  * uscan:
    + Repack the tarball and verify it is a compressed archive without
      allowing arbitrary code execution.  Fixes CVE-2013-6888.

Comment 5 Murray McAllister 2014-02-13 07:20:48 UTC
(In reply to Murray McAllister from comment #4)
> http://seclists.org/oss-sec/2014/q1/265 notes to more hardening commits:
> 
> http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git;a=commitdiff;
> h=4b7e58ee6000cdefac0682601cec6ecce0137467

This one was assigned CVE-2013-7325.

Reference: http://seclists.org/oss-sec/2014/q1/334


Note You need to log in before you can comment on or make changes to this bug.