oss-security - CVE Request: ack-grep: potential remote code execution via per-project .ackrc files

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131210134925.GA22804@lorien.valinor.li>
Date: Tue, 10 Dec 2013 14:49:25 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Cc: Axel Beckert <abe@...ian.org>
Subject: CVE Request: ack-grep: potential remote code execution via
 per-project .ackrc files

Hi

I would like to request a CVE for the following vulnerability in
ack-grep:

 https://github.com/petdance/ack2/issues/399

Upstream for ack-grep fixed a security issue which could possibly lead
to a remote code execution:

2.12    Tue Dec  3 07:05:02 CST 2013
====================================
[SECURITY FIXES]
This verison of ack prevents the --pager, --regex and --output
options from being used from project-level ackrc files.  It is
possible to execute malicious code with these options, and we want
to prevent the security risk of acking through a potentially malicious
codebase, such as one downloaded from an Internet site or checked
out from a code repository.

The --pager, --regex and --output options may still be used from
the global /etc/ackrc, your own private ~/.ackrc, the ACK_OPTIONS
environment variable, and of course from the command line.

The relevant commit seems to be

https://github.com/petdance/ack2/commit/a9233abad71225c1cfb300c03841c723bceb0f07

(plus some adjusting the testsuite).

Reference in the Debian Bugtracker:

 http://bugs.debian.org/731848

See also https://github.com/petdance/ack2/issues/414 which contains further
restrictions to the command line options.

Could a CVE be assigned to this issue?

Regards,
Salvatore

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.