oss-sec mailing list archives
kdesu vulnerability: need CVE
From: Albert Astals Cid <aacid () kde org>
Date: Wed, 28 Sep 2016 23:35:43 +0200
Hi, Albert from KDE, can we get a CVE assigned for kdesu? The problem is that you could sneak an unicode string terminator in the kdesu invocation and the label showing which command will be executed ended there but we did execute the whole thing, that is, echo Hi@; whoami > /tmp/filebyroot If @ is the unicode string terminator would only tell the user kdesu would execute "echo Hi" but would create the /tmp/filebyroot file as root The fix is already available at https://github.com/KDE/kde-cli-tools/commit/5eda179a099ba68a20dc21dc0da63e85a565a171 Thanks, Albert
Current thread:
- kdesu vulnerability: need CVE Albert Astals Cid (Sep 28)
- Re: kdesu vulnerability: need CVE cve-assign (Sep 29)