oss-security - CVE Request: cgit command injection

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHmME9pHSbgtfd9NZA7mL5RTsid9-8kQR1TSSf9wpmZMLAXTFA@mail.gmail.com>
Date: Sat, 27 Oct 2012 20:10:15 -0600
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: oss-security <oss-security@...ts.openwall.com>
Cc: cgit@...mli.net
Subject: CVE Request: cgit command injection

Hi Kurt,

>From http://git.zx2c4.com/cgit/commit/?id=7ea35f9f8ecf61ab42be9947aae1176ab6e089bd
:

"syntax-highlighting.sh: Fix command injection.

By not quoting the argument, an attacker with the ability to add files
to the repository could pass arbitrary arguments to the highlight
command, in particular, the --plug-in argument which can lead to
arbitrary command execution.

This patch adds simple argument quoting."

The vulnerable script is not a hard requirement and is more in the
"contrib" variety of things. That said, lots of users do wind up using
it verbatim, as it's simple and works well, so this does affect a
decent number of folks.

The patch for it will be released in the upcoming cgit release, along
with the previous CVE for that buffer overflow. I'll send the list an
update when that release is made.

Thanks,
Jason

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.