CVE-2017-7239: ninka license identification tool: insufficient escaping of external input [vs]

[Dirk-Willem van Gulik <dirkx () webweaving org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


             ninka license identification tool
          insufficient escaping of external input

                CVE-2017-7239 / CVSS 9.3
                        1.06

The ninka license identification tool does not properly escape
special characters in the files it encounters - such as the ‘&’.

In case of an alien code bases; or a code base that is brought in for
examination - a third party may doctor the file names as to cause 
a certain result of the license compliance scan. Or the attacker may 
adversely affect the ninka user their environment (e.g. an automated
continuous integration setup) by causing it to hang.

This can then lead to unauthorised disclosure of information,
unreliable compliance information or a denial of services.

Versions affected: 
- - ------------------
All versions up to and including version 1.3.

Resolution:
- - -----------
Upgrade to version 1.3.1 or later - available on
https://github.com/dmgerman/ninka. As of commit
75fb67c36a1c4dcec6b9b2c4e7102a1000066c4f the tool
give an error when 'illegal characters' are detected.

Mitigations and work arounds:
- - -----------------------------
Test the filenames passed for obvious issues. Given that ninka is
generally only applied to (source)code - a regex matching just
the alphanumerics and a few glyphs such as the dash and dot
can usually be applied.

Credits and timeline
- - --------------------
The flaw was found and reported by Dirk-Willem van Gulik <dirkx
@ webweaving.org) on the 12 of March 2017. D.M. German <dmg
@ turingmachine.org >  fixed the issue on the 27th of March 2017.

2017-01-28      vulnerability found, reported to authors.
2017-03-21      sample found in alien codebase.
2017-03-23      reported to more recent email addresses of authors .
2017-03-26      reported to the authors by phone.
2017-03-27      CVE issued by mitre. fix created by author and
                pushed to github.
2017-04-01      Full disclosure.

Common Vulnerability Scoring (Version 3) and vector
- - ---------------------------------------------------
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RC:R/CR:L/IR
  :L/AR:L/MAV:L/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H

CVSS Base Score          9.3
CVSS Temporal Score      9.0
CVSS Environmental Score 6.4

1.06 / : 2717 $
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0

iEYEARECAAYFAljhGecACgkQ/W+IxiHQpxtywwCePUZgUJJ2Z3ly9Bfxk/EOz/aG
PQ8AoIF6Bc6cRV8862314Lf3Eod6Om0g
=AwPW
-----END PGP SIGNATURE-----


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/