[<prev] [next>] [day] [month] [year] [list]
Message-ID: <54A434A9.3000907@blindspotsecurity.com>
Date: Wed, 31 Dec 2014 09:38:49 -0800
From: "Timothy D. Morgan" <tim.advisories@...ndspotsecurity.com>
To: oss-security@...ts.openwall.com
Subject: Command Injection in mime-support/run-mailcap (CVE-2014-7209)
Hello,
I discovered a shell injection vulnerability in the run-mailcap script of the
mime-support package. This vulnerability is exploitable in a variety of very
specific scenarios when an attacker can convince a victim to open a file with a
malicious file name using the run-mailcap script. Only a handful of software
packages (such as email clients) are likely to call run-mailcap directly, but it can
also be called by xdg-open, which is much more widely used. However, in the xdg-open
case, the victim must not be using one of the popular desktop environments in order
for the issue to be triggered. In the xdg-open case, it was possible to execute
arbitrary code using Google Chrome/Chromium file downloads as a vector. (Yes, this
is a separate issue from the xdg-open shell injection vulnerability that was reported
not long ago.)
It seems that mime-support is primarily used by Debian-based Linux distributions,
though FreeBSD does have a port for it. I'm not sure what other distros may make it
available. Debian has released a security update (DSA-3114-1) for the issue. I am
also attaching patches which correct the flaw in the previous version.
Thanks to Salvatore Bonaccorso and Charles Plessy for developing the patches.
tim
View attachment "0001-CVE-2014-7209-Fix-shell-command-injection.patch" of type "text/x-patch" (2486 bytes)
View attachment "0002-Resolve-file-name-to-an-absolute-path.patch" of type "text/x-patch" (1615 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
