full-disclosure - Re: [FD] xdg-open RCE

Open Source and information security mailing list archives

Message-ID: <CAOJKFBDVV91ayBk4=_brcExq6P33W=JXHF6nMWF6cdGv7xHx-g@mail.gmail.com>
Date: Fri, 14 Nov 2014 19:59:42 -0600
From: Brandon Perry <bperry.volatile@...il.com>
To: joernchen <joernchen@...noelit.de>
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] xdg-open RCE

This is very similar to this gksu bug (which only applies to gksu when in
SU_MODE)

http://savannah.nongnu.org/bugs/?40023

Attempted to email the gksu 'maintainer', but with no response.

Did a quick write up on the Rapid7 site on how I found out about it and the
vector I was using to exploit it:

https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu

Was assigned the following CVE:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2886

On Fri, Nov 14, 2014 at 4:50 PM, joernchen <joernchen@...noelit.de> wrote:

> Hi,
>
> I just ran into some RCE issue with xdg-open today and figured it's known
> and unfixed since 2013-06-10 [0] (respectively 2013-07-07 upstream [1])
>
> As apparently noone cares about this I just leave a silly PoC [3]
> (should work with Chromium on Arch/Gentoo Linux) here. Additional
> requirement is a Window Manager which is _NOT_ one of the following:
>
> * KDE
> * GNOME
> * MATE
> * XFCE
> * ENLIGHTENMENT
>
>
> Cheers,
>
> joernchen
>
> [0] https://bugs.gentoo.org/show_bug.cgi?id=472888
> [1] https://bugs.freedesktop.org/show_bug.cgi?id=66670
> [3] http://phenoelit.org/stuff/xdg-open.html
> --
> joernchen ~ Phenoelit
> <joernchen@...noelit.de> ~ C776 3F67 7B95 03BF 5344
> http://www.phenoelit.de  ~ A46A 7199 8B7B 756A F5AC
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/
>

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives