oss-sec mailing list archives
OS command injection vulnerability in Chicken Scheme
From: Peter Bex <Peter.Bex () xs4all nl>
Date: Sun, 21 Apr 2013 21:11:26 +0200
Hello, I'd like to request a CVE identifier for a bug in Chicken Scheme which allows a malicious user to cause shell command execution through injection of a pipe symbol and possibly other shell meta characters. This bug is present in all versions of CHICKEN. It will be fixed in 4.8.3 and 4.8.2 as per commit 58684f69572453acc6fed7326fa9df39be98760e. Version 4.9.0 will likely be the first stable release to include this fix, unless it is decided to backport this fix to the stability release. The full announcement is here: http://lists.nongnu.org/archive/html/chicken-announce/2013-04/msg00000.html By the way, I'm confused as to why the CVEs I've requested so far don't show up in NVD. For example, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6122 says the CVE does not exist, but Kurt assigned it in February: http://www.openwall.com/lists/oss-security/2013/02/08/2 The other CVE numbers in that mail produce a "not found" page as well and an NVD database search for "chicken" turns up nothing related to Chicken Scheme. The page says the database was last updated April 19th 2013, so that's not the cause either. Cheers, Peter Bex -- http://www.more-magic.net
Current thread:
- OS command injection vulnerability in Chicken Scheme Peter Bex (Apr 21)
- Re: OS command injection vulnerability in Chicken Scheme Kurt Seifried (Apr 29)
- Re: OS command injection vulnerability in Chicken Scheme Peter Bex (Apr 29)
- Re: OS command injection vulnerability in Chicken Scheme Kurt Seifried (Apr 29)
- RE: OS command injection vulnerability in Chicken Scheme Christey, Steven M. (Apr 29)
- Re: OS command injection vulnerability in Chicken Scheme Kurt Seifried (Apr 29)
- Re: OS command injection vulnerability in Chicken Scheme Peter Bex (Apr 29)
- Re: OS command injection vulnerability in Chicken Scheme Kurt Seifried (Apr 29)