oss-security - kdesu vulnerability: need CVE

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <122945095.MCtYvXDq6T@xps>
Date: Wed, 28 Sep 2016 23:35:43 +0200
From: Albert Astals Cid <aacid@....org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Cc: CVE Assignments MITRE <cve-assign@...re.org>, security@....org
Subject: kdesu vulnerability: need CVE

Hi, Albert from KDE, can we get a CVE assigned for kdesu?

The problem is that you could sneak an unicode string terminator in the kdesu invocation
and the label showing which command will be executed ended there but we did execute the whole thing,
that is,
  
   echo Hi@; whoami > /tmp/filebyroot

If @ is the unicode string terminator would only tell the user kdesu would execute "echo Hi"
but would create the /tmp/filebyroot file as root

The fix is already available at
https://github.com/KDE/kde-cli-tools/commit/5eda179a099ba68a20dc21dc0da63e85a565a171

Thanks,
  Albert

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.