| Summary: | app-misc/run-mailcap: Command Injection | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED OBSOLETE | ||
| Severity: | normal | CC: | maintainer-needed |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.openwall.com/lists/oss-security/2014/12/31/8 | ||
| Whiteboard: | B2 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
is 3.52_p1 version from testing also affected by this? (In reply to Pacho Ramos from comment #1) > is 3.52_p1 version from testing also affected by this? 3.52_p1 seems to still have the issue (visual inspection shows patches not applied). Version 3.60 does seem to contain (a better version) of the patches. No visible regressions. If no one is willing to proxy maintain this, I guess we should treeclean this https://wiki.gentoo.org/wiki/Project:Proxy_Maintainers removed Package removed from tree. |
From ${URL} : I discovered a shell injection vulnerability in the run-mailcap script of the mime-support package. This vulnerability is exploitable in a variety of very specific scenarios when an attacker can convince a victim to open a file with a malicious file name using the run-mailcap script. Only a handful of software packages (such as email clients) are likely to call run-mailcap directly, but it can also be called by xdg-open, which is much more widely used. However, in the xdg-open case, the victim must not be using one of the popular desktop environments in order for the issue to be triggered. In the xdg-open case, it was possible to execute arbitrary code using Google Chrome/Chromium file downloads as a vector. (Yes, this is a separate issue from the xdg-open shell injection vulnerability that was reported not long ago.) It seems that mime-support is primarily used by Debian-based Linux distributions, though FreeBSD does have a port for it. I'm not sure what other distros may make it available. Debian has released a security update (DSA-3114-1) for the issue. I am also attaching patches which correct the flaw in the previous version. @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.