Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 128136 - app-misc/beagle: Untrusted search path vulnerability (CVE-2006-1296)
Summary: app-misc/beagle: Untrusted search path vulnerability (CVE-2006-1296)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High trivial (vote)
Assignee: Gentoo Security
URL: http://cve.mitre.org/cgi-bin/cvename....
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-03-30 09:53 UTC by Raphael Marichez (Falco) (RETIRED)
Modified: 2006-03-30 10:53 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-03-30 09:53:26 UTC 
The script "beagle-status" calls "beagle-info" giving preference to the copy that is located within the user's current working directory, rather than the original copy.

An attacker can force the user to execute code, with a malicious copy of "beagle-info" located in the user's current directory.

see
http://xforce.iss.net/xforce/xfdb/25303
http://secunia.com/advisories/19278
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=357392

Beagle has no stable ebuild.
Comment 1 Luis Medinas (RETIRED) gentoo-dev 2006-03-30 10:20:52 UTC 
looks like this only afects beagle 0.2.2.1
I'll look for a patch in case of beagle 0.2.3 is afected too.
Comment 2 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-03-30 10:25:00 UTC 
well, AFAI can say :

if [ -x "./beagle-info" ]; then
    CMD="./beagle-info"
else
    CMD="beagle-info"
fi


is both in beagle-status and beagle-ping

fix is trivial, but i'am not sure this is wanted by the upstream (and by you). Maybe a warn to the user ?
Comment 3 Luis Medinas (RETIRED) gentoo-dev 2006-03-30 10:53:55 UTC 
fixed on cvs i might look at this patch later because that fix sucks. :)

Thanks guys.