Bug 299887 – <www-client/uzbl-2010.01.05: Arbitrary command execution (CVE-2010-0011)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Alex Legler (RETIRED) 2010-01-06 13:02:33 UTC]

From $URL:

Simon Lipp brought to our attention a nasty security bug.
Apparently there are ways for javascripts from a website to reach our 'Uzbl'
object an use its "run" function, by using DOM method overriding, stack
inspection and maybe more.
[...]
But basically, if site admins modify their JS they can use the 'Uzbl.run'
feature to execute uzbl commands (such as shell commands).

Reproducer: http://users.edpnet.be/dieter/exploit.html

[Comment 1 Alex Alexander (RETIRED) 2010-01-06 15:39:15 UTC]

I fixed this last night, the only version available in portage now is uzbl-2010.01.05 which has the fix :)

[Comment 2 Alex Legler (RETIRED) 2010-01-06 16:11:05 UTC]

(In reply to comment #1)
> I fixed this last night, the only version available in portage now is
> uzbl-2010.01.05 which has the fix :)
> 

Please file a bug next time you bump something that contains security fixes.

~arch only → noglsa

[Comment 3 Tobias Heinlein (RETIRED) 2010-03-01 12:31:32 UTC]

CVE-2010-0011 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0011):
  The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes
  the run method of the Uzbl object, which allows remote attackers to
  execute arbitrary commands via JavaScript code.