oss-sec mailing list archives
Re: was: SA29489 CenterIM URL handling flaw
From: Lubomir Kundrak <lkundrak () redhat com>
Date: Wed, 26 Mar 2008 08:21:49 +0100
On Tue, 2008-03-25 at 16:26 +0100, Nico Golde wrote:
Hi, * Nico Golde <oss-security+ml () ngolde de> [2008-03-25 16:25]:* Lubomir Kundrak <lkundrak () redhat com> [2008-03-24 15:08]:Ad SA29489 [1] "CenterIM URL Parsing Command Execution Vulnerability" CenterIM does completely nothing with received URLs. Maybe the unfortuate "exploit writer" was using XFCE Terminal [2], or a terminal emulator with a similar problem.That's partly true. While centerim has no special URL handler to handle incoming urls it does provide the ability to list urls in a message by pressing F2. If you press enter on one of these urls it tries to open it in an external browser and executes the other commands as well. You see the commands in the URL however so I think the impact of this is like sending someone a message with "please type rm -rf ~ in your shell" so the secunia rating is a bit beyond the actual impact.upstream patch: http://repo.or.cz/w/centerim.git?a=blobdiff_plain;f=src/icqconf.cc;fp=src/icqconf.cc;hb=b28c6deaef58eb685a2d747b28b6a572122730d4;hpb=ad6ad53ebf791f97cb7337dc79ab2ce8ccb1246f
The patch doesn't apply by itself, without the previous one, and is not quite correct. If the user created a vulnerable actions file (by launching centerim before), that one won't be overwritten without manual action taken by the user. Also, the script is not technically correct (overriding DISPLAY variable), and is completely useless bloat. Upstream is aware of this and concentrates on making CIM5 better :) Fedora will use this patch [1], that removes configurable actions completely. [1] http://cvs.fedora.redhat.com/viewcvs/rpms/centerim/devel/centerim-4.22.3-url-escape-fedora.patch?rev=1.1&view=markup Note that current Yahoo IM implementation will not work after April 2nd, and new one is not yet complete. It might make sense to delay the update a few days and grab the YIM patches from mob branch then. Regards, -- Lubomir Kundrak (Red Hat Security Response Team)
Current thread:
- SA29489 CenterIM URL handling flaw Lubomir Kundrak (Mar 24)
- was: SA29489 CenterIM URL handling flaw Nico Golde (Mar 25)
- Re: was: SA29489 CenterIM URL handling flaw Nico Golde (Mar 25)
- Re: was: SA29489 CenterIM URL handling flaw Lubomir Kundrak (Mar 26)
- Re: was: SA29489 CenterIM URL handling flaw Steven M. Christey (Mar 27)
- Re: was: SA29489 CenterIM URL handling flaw Nico Golde (Mar 27)
- Re: was: SA29489 CenterIM URL handling flaw Nico Golde (Mar 25)
- was: SA29489 CenterIM URL handling flaw Nico Golde (Mar 25)