Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 478288 (CVE-2013-1436) - <x11-wm/xmonad-contrib-0.11.2 : Remote command injection (CVE-2013-1436)
Summary: <x11-wm/xmonad-contrib-0.11.2 : Remote command injection (CVE-2013-1436)
Status: RESOLVED FIXED
Alias: CVE-2013-1436
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-07-26 20:03 UTC by Agostino Sarubbo
Modified: 2014-05-28 06:51 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-07-26 20:03:33 UTC
From ${URL} :

Hello,

I've discovered a remote command injection vulnerability in xmonad-contrib.
The vulnerability is in the XMonad.Hooks.DynamicLog module. It has been
assigned the name CVE-2013-1436.

Background
==========
DynamicLog module feeds information to others programs about what's
happening on xmonad window manager. Such programs generally are status bars
as xmobar or dzen2. These programs features the ability of receiving
formatted input from stdin, and that's the way used by xmonad to
communicate information such as workspace status, current layout and window
title. So far, so good.

Both bars uses some meta-language to format their input. For example,
xmobar will make the following text clickable.

  <action=xclock>Click to clock</action>

Vulnerability & exploit
=======================
As we know, web browsers usually set the window title to the current tab. A
malicious user, then, can craft a special title in order to inject commands
in the current bar. In xmobar this will be something like this:

<html>
        <head>
                <title>&lt;action=xclock&gt;An innocent title&lt;/action&gt;</title>
        </head>
        <body>
                <h1>Good bye, cruel world</h1>
        </body>
</html>

So, if the user accidentally (or incidentally) clicks on the xmobar window
title, the command will be executed. In dzen2 this is also possible,
although I haven't tried to execute code. A (harmless) proof of concept is
attached for both bars. The proof for dzen2 just changes the background
color of the bar.

Fix
===
A fix for this issue is already available in xmonad webpage[0]. A patch
written by Adam Vogt can be retrieved from the commit in the darcs repo[1].
If you use this module, please make sure to recompile your xmonad binary
after upgrading the package.

I would like to thank Joachim Breitner and the Debian Security Team for
their help in disclosing this issue.

Cheers.

[0] http://hackage.haskell.org/packages/archive/xmonad-contrib/0.11.2/xmonad-contrib-0.11.2.tar.gz
[1] 
http://handra.rampa.sk/dawb/patch?repoPURL=http%3A%2F%2Fcode.haskell.org%2FXMonadContrib&repoPHash=20130708144813-1499c-0c3e284d3523c0694b9423714081761813bc1e89


@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
Comment 1 Sergei Trofimovich gentoo-dev 2013-07-27 06:51:00 UTC
Pushed as:

>*xmonad-contrib-0.11.2 (27 Jul 2013)
> 
>  27 Jul 2013; Sergei Trofimovich <slyfox@gentoo.org>
>  +xmonad-contrib-0.11.2.ebuild:
>  Version bump (fixes CVE-2013-1436).

Will require stabilising

  x86, amd64

at least the following packages:

=x11-wm/xmonad-contrib-0.11.2
=dev-haskell/x11-1.6.1.1
=dev-haskell/data-default-0.5.3
=dev-haskell/data-default-class-0.0.1
=dev-haskell/data-default-instances-base-0.0.1
=dev-haskell/data-default-instances-containers-0.0.1
=dev-haskell/data-default-instances-dlist-0.0.1
=dev-haskell/data-default-instances-old-locale-0.0.1
=dev-haskell/dlist-0.5-r1
=x11-wm/xmonad-0.11-r1

All, except today's xmonad-contrib-0.11.2 sit in the tree for some months.
Comment 2 Agostino Sarubbo gentoo-dev 2013-07-27 15:52:20 UTC
(In reply to Sergei Trofimovich from comment #1)
> Pushed as:
> 
> >*xmonad-contrib-0.11.2 (27 Jul 2013)
> > 
> >  27 Jul 2013; Sergei Trofimovich <slyfox@gentoo.org>
> >  +xmonad-contrib-0.11.2.ebuild:
> >  Version bump (fixes CVE-2013-1436).
> 
> Will require stabilising
> 
>   x86, amd64
> 
> at least the following packages:
> 
> =x11-wm/xmonad-contrib-0.11.2
> =dev-haskell/x11-1.6.1.1
> =dev-haskell/data-default-0.5.3
> =dev-haskell/data-default-class-0.0.1
> =dev-haskell/data-default-instances-base-0.0.1
> =dev-haskell/data-default-instances-containers-0.0.1
> =dev-haskell/data-default-instances-dlist-0.0.1
> =dev-haskell/data-default-instances-old-locale-0.0.1
> =dev-haskell/dlist-0.5-r1
> =x11-wm/xmonad-0.11-r1
> 
> All, except today's xmonad-contrib-0.11.2 sit in the tree for some months.

this list is fine from a repoman side.
Comment 3 Chris Reffett gentoo-dev Security 2013-07-27 15:55:10 UTC
All right then. Arches, please stabilize the packages from comment #1, target arches: amd64 x86. Thanks!
Comment 4 Agostino Sarubbo gentoo-dev 2013-07-27 21:54:52 UTC
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2013-07-29 05:28:50 UTC
x86 stable
Comment 6 Chris Reffett gentoo-dev Security 2013-08-23 14:58:25 UTC
GLSA vote: yes
Comment 7 Sergey Popov gentoo-dev Security 2014-02-27 14:01:24 UTC
GLSA vote: yes

GLSA request filed
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2014-05-28 06:51:06 UTC
This issue was resolved and addressed in
 GLSA 201405-28 at http://security.gentoo.org/glsa/glsa-201405-28.xml
by GLSA coordinator Sergey Popov (pinkbyte).