CVE-2014-9622
CVSS6.8
发布时间 :2015-01-21 13:59:08
修订时间 :2017-06-30 21:29:09
NMCPS    

[原文]Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.


[CNNVD]xdg-utils Eval注入漏洞(CNNVD-201501-486)

        

xdg-utils是一套用于帮助应用程序与各种桌面任务进行集成的命令行工具。

xdg-utils 1.1.0 RC1版本中存在Eval注入漏洞。攻击者可借助‘URL’参数利用该漏洞执行任意代码。

- CVSS (基础分值)

CVSS分值: 6.8 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: MEDIUM [漏洞利用存在一定的访问条件]
攻击向量: NETWORK [攻击者不需要获取内网访问权或本地访问权]
身份认证: NONE [漏洞利用无需身份认证]

- CWE (弱点类目)

CWE-77 [在命令中使用的特殊元素转义处理不恰当(命令注入)]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9622
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9622
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-201501-486
(官方数据源) CNNVD

- 其它链接及资源

http://seclists.org/fulldisclosure/2014/Nov/36
(UNKNOWN)  FULLDISC  20141114 xdg-open RCE
http://www.debian.org/security/2015/dsa-3131
(UNKNOWN)  DEBIAN  DSA-3131
http://www.openwall.com/lists/oss-security/2015/01/17/10
(UNKNOWN)  MLIST  [oss-security] 20150117 Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability
http://www.securityfocus.com/bid/71284
(UNKNOWN)  BID  71284
https://bugs.freedesktop.org/show_bug.cgi?id=66670
(UNKNOWN)  CONFIRM  https://bugs.freedesktop.org/show_bug.cgi?id=66670
https://bugs.gentoo.org/show_bug.cgi?id=472888
(UNKNOWN)  CONFIRM  https://bugs.gentoo.org/show_bug.cgi?id=472888
https://security.gentoo.org/glsa/201701-09
(UNKNOWN)  GENTOO  GLSA-201701-09

- 漏洞信息

xdg-utils Eval注入漏洞
中危 代码注入
2015-01-23 00:00:00 2015-01-23 00:00:00
远程  
        

xdg-utils是一套用于帮助应用程序与各种桌面任务进行集成的命令行工具。

xdg-utils 1.1.0 RC1版本中存在Eval注入漏洞。攻击者可借助‘URL’参数利用该漏洞执行任意代码。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:
        http://www.linuxfromscratch.org/blfs/view/svn/xsoft/xdg-utils.html

- 漏洞信息 (F129999)

Debian Security Advisory 3131-1 (PacketStormID:F129999)
2015-01-19 00:00:00
Debian  debian.org
advisory,arbitrary
linux,debian
CVE-2014-9622
[点击下载]

Debian Linux Security Advisory 3131-1 - John Houwer discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3131-1                   security@debian.org
http://www.debian.org/security/                           Michael Gilbert
January 18, 2015                       http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : xdg-utils
CVE ID         : CVE-2014-9622
Debian Bug     : 773085

John Houwer discovered a way to cause xdg-open, a tool that automatically
opens URLs in a user's preferred application, to execute arbitrary
commands remotely.

For the stable distribution (wheezy), this problem has been fixed in
version 1.1.0~rc1+git20111210-6+deb7u2.

For the upcoming stable (jessie) and unstable (sid) distributions,
this problem has been fixed in version 1.1.0~rc1+git20111210-7.3.

We recommend that you upgrade your xdg-utils packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQQcBAEBCgAGBQJUvIOpAAoJELjWss0C1vRzyfIgAL+XQ0ld3B3JXgdPJQQpfdaY
00JPoJhdpOEBxofEiAgkNd7EV2COkmRPO0ekvhxEKavxd9oxUWmNyK9bZ+LaVcDg
OQtAE57gSTF3qFbgOsuPkU0q6eMVPzH+kSxuXBV5962LNKTvdNnnWlri70aB5JLW
rMXdcGkOlh0ozDe5CNz3wZRZGUmbDyRbd29F+BtfAqH7fBtrCBUifwr00A24E6aS
+DIgCSMg5GUuAU3SfTh1xSE3+rfU2uxnTYC1ZdrnJrlBiMIqfitNaE2QOVw8RrAm
PA62BWnbkHJmTHmG0NfAlU5mv3QcaXG9QEny0Plh6QsL1myjkUngH+g/EfdGg845
LNU84A8U19YGfXdWD+dCol11c5mfAPk5NQdtapo9LuP3Hx05MDYVxXCfupbsEV1i
AMHplt7jhnjAsZhgb0RGzgIbi8OEk8rEL+hCiwzzHnmL1RjtHiByhOMFf7ZpbTNA
tF7/cDNchhVaxJ+iKId9JBB0X2FIRrJVfZST6LT3hoCV0nUwjeiTMQTz1Lshs/8Q
EoUfLpJJDemdnk2otXNPGDD4kzJMdpsZx+u77Pm7ZD45LaWuVoROUrk2j4MRwHzK
sI2B+8FA5GKiG1XWRmvTaqm9NZl/N8C2IVmvw1yPDVdSQ0cn90NeJdjcqFt9VV1e
RljXNebLmbE0eLXvhB2ZHPmEy/uedzr2isrLzvejU2NyJKE4qwmc4Xv1o9cxT85J
lh4KOPkOEIgTAsKvywG1bilv5cNLhliEN7CzcFO2AIDIYLz4Txy8WiOHHEIYxTWt
DlhdcXACQ/jpzt8dZh+yMUU33FjsO7fLSb7eaGe0FIx8juZG5gIr0OTg/6eZi+Eb
ruaOCGsKHV0uKBIvID22nDjJnvKsp0fDzKDTz9522ypNQI7k3Krv7I7nM46Y9oN8
n1gVKH0DflS/eZnMDgixUoBHg35pFPSz6FpSAcZRPFxCBU45+K2u0ZZ7Yq1BwEWc
c8c12hVnydyIdNmdqVNIXfcdal+fAZd3ZD9fS53UMQac+RnU5LnLHVaZuyMkITyw
IjJWolZj5JfENaEOEPOkspzm48cu/vp+u4yBnMMy7KyuXGI8y5rQGQIF1/7QJ/SJ
kWVE+qFiI2OPCMQlcyvEZqcaiBqXVrA8kAtH4P0fzz09M806+kb3dqzmxiEUweR7
YaRWSBLir9t6LXRAgAEw1v6oKxwMUWc5ES63QvHultdc4rhB2tFwwuvg0aYXVi3+
HEm7O44WhX5qQgqOUY0N2AJB30i7VNelwLK2Xt3wm/ychcHhkv+otLp17WvBVjA+
6LnJAClnPFm1CLJbpVMi9iebHkw9kJDsN2CZqVs6clSGVYYzIMfogg8969Qona8=
=TI29
-----END PGP SIGNATURE-----
    

- 漏洞信息 (F140322)

Gentoo Linux Security Advisory 201701-09 (PacketStormID:F140322)
2017-01-02 00:00:00
Gentoo  security.gentoo.org
advisory,arbitrary
linux,gentoo
CVE-2014-9622
[点击下载]

Gentoo Linux Security Advisory 201701-9 - A command injection vulnerability in Xdg-Utils may allow for the execution of arbitrary code. Versions less than 1.1.1 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201701-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal
    Title: Xdg-Utils: Command injection
     Date: January 01, 2017
     Bugs: #472888
       ID: 201701-09

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A command injection vulnerability in Xdg-Utils may allow for the
execution of arbitrary code.

Background
==========

Xdg-Utils is a set of tools allowing all applications to easily
integrate with the Free Desktop configuration.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  x11-misc/xdg-utils           < 1.1.1                    >= 1.1.1

Description
===========

An eval injection vulnerability was discovered in Xdg-Utils.

Impact
======

A context-dependent attacker could execute arbitrary code via the URL
argument to xdg-open.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Xdg-Utils users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=x11-misc/xdg-utils-1.1.1"

References
==========

[ 1 ] CVE-2014-9622
      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9622

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/201701-09

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2017 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5


--8N3tjMgvGlTvsoCsMH60rAsk2SXGAMLcn--

    

- 漏洞信息

xdg-utils 'xdg-open' Remote Command Injection Vulnerability
Input Validation Error 71284
Yes No
2013-06-10 12:00:00 2015-02-20 12:01:00
john.houwer

- 受影响的程序版本

Xdg-utils Xdg-utils 0

- 漏洞讨论

xdg-utils is prone to a remote command-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary commands in context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

- 漏洞利用

Attackers can exploit this issue using readily available tools.

- 解决方案

Updates are available. Please see the references or vendor advisory for more information.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站