Podbeuter podcast fetcher: remote code execution

[Alexander Batischev <eual.jp () gmail com>]

Podbeuter is a podcast fetcher and player that's developed alongside 
with Newsbeuter, an RSS/Atom feed reader for text consoles.

Versions 0.3 through 2.9 are vulnerable to remote code execution. An 
attacker can craft an RSS item where the name of media enclosure
(the podcast file) contains shell code. When user plays the file in 
Podbeuter, the shell code will be executed.

A commit fixing the vulnerability in Git: 
https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260

A patch for Podbeuter 2.9: 
https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333

Upstream issue: https://github.com/akrennmair/newsbeuter/issues/598

I've requested a CVE from MITRE on August 27th, but haven't heard back 
yet, so decided to disclose without a number.

--
Regards,
Alexander Batischev

PGP key 356961A20C8BFD03
Fingerprint: CE6C 4307 9348 58E3 FD94  A00F 3569 61A2 0C8B FD03

Attachment: signature.asc
Description: