oss-security - CVE Request (minor) -- osc: Improper sanitization of terminal emulator escape sequences when displaying build log and build status

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F4D1564.9050000@redhat.com>
Date: Tue, 28 Feb 2012 18:56:52 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security@...ts.openwall.com, Marcus Meissner <meissner@...e.de>
Subject: CVE Request (minor) -- osc: Improper sanitization of terminal emulator
 escape sequences when displaying build log and build status

Hello Kurt, Steve, Marcus, vendors,

   a security flaw was found in the way osc, the Python language based command
line client for the openSUSE build service, displayed build logs and build
status for particular build. A rogue repository server could use this flaw to
modify window's title, or possibly execute arbitrary commands or overwrite
files via a specially-crafted build log or build status output containing an
escape sequence for a terminal emulator.

References:
[1] https://bugzilla.novell.com/show_bug.cgi?id=749335
[2] https://bugzilla.redhat.com/show_bug.cgi?id=798353

I need to conclude, I don't know how OBS repositories work (if there is a chance
of a rogue server being present). In any case, this issue is on the border
(pretty unlikely someone could alter content of OBS package during build --
in that case there would be more urgent issues than just particular terminal
window title change).

But strictly taken, the trust boundary is crossed in the moment, someone
would schedule OBS build and wouldn't expect the build log / status can
perform terminal "side" effect yet.

Marcus, please correct me if you don't agree this should get a CVE identifier.

If no one having objections and request appropriate, could you allocate one?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.