Re: kdesu vulnerability: need CVE

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> The problem is that you could sneak an unicode string terminator in the kdesu invocation
> and the label showing which command will be executed ended there but we did execute the whole thing,
> that is,
>
>    echo Hi@; whoami > /tmp/filebyroot
>
> If @ is the unicode string terminator would only tell the user kdesu would execute "echo Hi"
> but would create the /tmp/filebyroot file as root
>
> The fix is already available at
> https://github.com/KDE/kde-cli-tools/commit/5eda179a099ba68a20dc21dc0da63e85a565a171

> > Make sure people are not trying to sneak invisible characters on the kdesu label
> > kdesu.cpp

Use CVE-2016-7787.

- -- 
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
  http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJX7O5eAAoJEHb/MwWLVhi2ZJYP/3z7JAGJAtY4YkSyMy97A+q/
B5s3hRzWrvpZesyNf80sCuY0PvTnoMiS80nOWYlYVyERbr/1hVh7YQ+GLzpEs/ud
KPhYqhPVNO/tC9ELW1LkAwaYKI4zJXf7yZFIgsuCZI1tgriRf+ehS40eg3tBnCoF
d03nbntQH5ADVZH+KxnnaKMZFfBRQDcMBP7XTcrfXCN5czju13TEWTYKPtL1s4rm
UlyeDQzJ9n+ou6NpNo9HfY+4QILw6mOHrxGl/SczeFgdCCJBwLvXiMAQXi8lLe0z
TmB7eCT1E8Bm7gpGQJUlcoD1PCBRHq1k6hCiTRLupkmYXHGjwWzJRMKqnnG5Stej
0/W5jLd7NQwm003RLwePVWvDw6TVbdZY6tJIMXqkYXc+Qqxx71TtY6/P4U/97Va3
8O8vovP1Xxbui1Xx9dUTU+F/XiG4kjV21XsN+5gAlWFA22v0gGKEvdY4uze5kNH6
dwxj2xTdJKEHIr8cPQeBOBxd46sIChmQWywO9uMMfwUoDS3xHkyq3WkCoI5YalnO
Dx8l5erpytJA8or3hKld0BIk2MTpJI/0zdyl0JqXuleIBjtlAFRMuyclg4n6S9Ek
VXRNWAslPgl+mPquZnyKxCKHfvpgk7ZT5qbU4iqOAv1CabODk+024XrdhHDzCTOQ
/T8u7gshajO1VsGhTTey
=Zeft
-----END PGP SIGNATURE-----