lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAOJKFBDVV91ayBk4=_brcExq6P33W=JXHF6nMWF6cdGv7xHx-g@mail.gmail.com> Date: Fri, 14 Nov 2014 19:59:42 -0600 From: Brandon Perry <bperry.volatile@...il.com> To: joernchen <joernchen@...noelit.de> Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org> Subject: Re: [FD] xdg-open RCE This is very similar to this gksu bug (which only applies to gksu when in SU_MODE) http://savannah.nongnu.org/bugs/?40023 Attempted to email the gksu 'maintainer', but with no response. Did a quick write up on the Rapid7 site on how I found out about it and the vector I was using to exploit it: https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu Was assigned the following CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2886 On Fri, Nov 14, 2014 at 4:50 PM, joernchen <joernchen@...noelit.de> wrote: > Hi, > > I just ran into some RCE issue with xdg-open today and figured it's known > and unfixed since 2013-06-10 [0] (respectively 2013-07-07 upstream [1]) > > As apparently noone cares about this I just leave a silly PoC [3] > (should work with Chromium on Arch/Gentoo Linux) here. Additional > requirement is a Window Manager which is _NOT_ one of the following: > > * KDE > * GNOME > * MATE > * XFCE > * ENLIGHTENMENT > > > Cheers, > > joernchen > > [0] https://bugs.gentoo.org/show_bug.cgi?id=472888 > [1] https://bugs.freedesktop.org/show_bug.cgi?id=66670 > [3] http://phenoelit.org/stuff/xdg-open.html > -- > joernchen ~ Phenoelit > <joernchen@...noelit.de> ~ C776 3F67 7B95 03BF 5344 > http://www.phenoelit.de ~ A46A 7199 8B7B 756A F5AC > > _______________________________________________ > Sent through the Full Disclosure mailing list > http://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ > -- http://volatile-minds.blogspot.com -- blog http://www.volatileminds.net -- website _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists