oss-sec mailing list archives
Re: was: SA29489 CenterIM URL handling flaw
From: "Steven M. Christey" <coley () linus mitre org>
Date: Thu, 27 Mar 2008 18:54:07 -0400 (EDT)
On Tue, 25 Mar 2008, Nico Golde wrote:
Hi, * Nico Golde <oss-security+ml () ngolde de> [2008-03-25 16:25]:* Lubomir Kundrak <lkundrak () redhat com> [2008-03-24 15:08]:Ad SA29489 [1] "CenterIM URL Parsing Command Execution Vulnerability" CenterIM does completely nothing with received URLs. Maybe the unfortuate "exploit writer" was using XFCE Terminal [2], or a terminal emulator with a similar problem.That's partly true. While centerim has no special URL handler to handle incoming urls it does provide the ability to list urls in a message by pressing F2. If you press enter on one of these urls it tries to open it in an external browser and executes the other commands as well.
This is the kind of situation that CVE adopted the "user-assisted" term for: the user assists the attacker in his/her own demise.
You see the commands in the URL however so I think the impact of this is like sending someone a message with "please type rm -rf ~ in your shell" so the secunia rating is a bit beyond the actual impact.
Is the URL still encoded at the time it is viewed? if so, then I don't expect a typical user to notice this equivalent of "rm -rf *": %72%6D%20%2D%72%66%20%2A and that's part of the "smell test" for user-assisted issues. Current CVE desc below. - Steve ====================================================== Name: CVE-2008-1467 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1467 Reference: MILW0RM:5283 Reference: URL:http://www.milw0rm.com/exploits/5283 Reference: BID:28362 Reference: URL:http://www.securityfocus.com/bid/28362 Reference: FRSIRT:ADV-2008-0956 Reference: URL:http://www.frsirt.com/english/advisories/2008/0956/references Reference: SECUNIA:29489 Reference: URL:http://secunia.com/advisories/29489 ** DISPUTED ** CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URI, related to "received URLs in the message window." NOTE: this issue has been disputed due to the user-assisted nature, since the URL must be selected and launched by the victim.
Current thread:
- SA29489 CenterIM URL handling flaw Lubomir Kundrak (Mar 24)
- was: SA29489 CenterIM URL handling flaw Nico Golde (Mar 25)
- Re: was: SA29489 CenterIM URL handling flaw Nico Golde (Mar 25)
- Re: was: SA29489 CenterIM URL handling flaw Lubomir Kundrak (Mar 26)
- Re: was: SA29489 CenterIM URL handling flaw Steven M. Christey (Mar 27)
- Re: was: SA29489 CenterIM URL handling flaw Nico Golde (Mar 27)
- Re: was: SA29489 CenterIM URL handling flaw Nico Golde (Mar 25)
- was: SA29489 CenterIM URL handling flaw Nico Golde (Mar 25)