full-disclosure - [FD] CVE-2017-7239: ninka license identification tool: insufficient escaping of external input [vs]

Open Source and information security mailing list archives

Date: Sun, 2 Apr 2017 17:45:38 +0200 (CEST)
From: Dirk-Willem van Gulik <dirkx@...weaving.org>
To: fulldisclosure@...lists.org
Subject: [FD] CVE-2017-7239: ninka license identification tool: insufficient
	escaping of external input [vs]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

             ninka license identification tool
          insufficient escaping of external input

                CVE-2017-7239 / CVSS 9.3
                        1.06

The ninka license identification tool does not properly escape
special characters in the files it encounters - such as the ‘&’.

In case of an alien code bases; or a code base that is brought in for
examination - a third party may doctor the file names as to cause 
a certain result of the license compliance scan. Or the attacker may 
adversely affect the ninka user their environment (e.g. an automated
continuous integration setup) by causing it to hang.

This can then lead to unauthorised disclosure of information,
unreliable compliance information or a denial of services.

Versions affected: 
- - ------------------
All versions up to and including version 1.3.

Resolution:
- - -----------
Upgrade to version 1.3.1 or later - available on
https://github.com/dmgerman/ninka. As of commit
75fb67c36a1c4dcec6b9b2c4e7102a1000066c4f the tool
give an error when 'illegal characters' are detected.

Mitigations and work arounds:
- - -----------------------------
Test the filenames passed for obvious issues. Given that ninka is
generally only applied to (source)code - a regex matching just
the alphanumerics and a few glyphs such as the dash and dot
can usually be applied.

Credits and timeline
- - --------------------
The flaw was found and reported by Dirk-Willem van Gulik <dirkx
@ webweaving.org) on the 12 of March 2017. D.M. German <dmg
@ turingmachine.org >  fixed the issue on the 27th of March 2017.

2017-01-28	vulnerability found, reported to authors.
2017-03-21	sample found in alien codebase.
2017-03-23	reported to more recent email addresses of authors .
2017-03-26	reported to the authors by phone.
2017-03-27	CVE issued by mitre. fix created by author and
                pushed to github.
2017-04-01	Full disclosure.

Common Vulnerability Scoring (Version 3) and vector
- - ---------------------------------------------------
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RC:R/CR:L/IR
  :L/AR:L/MAV:L/MAC:L/MPR:N/MUI:N/MS:U/MC:H/MI:H/MA:H

CVSS Base Score          9.3
CVSS Temporal Score      9.0
CVSS Environmental Score 6.4

1.06 / : 2717 $
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0

iEYEARECAAYFAljhGecACgkQ/W+IxiHQpxtywwCePUZgUJJ2Z3ly9Bfxk/EOz/aG
PQ8AoIF6Bc6cRV8862314Lf3Eod6Om0g
=AwPW
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives