PT-2017-14822 · Kildclient · Kildclient

Publicado 2017-12-14 · Atualizado 2019-04-26 · CVE-2017-17511

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KildClient version 3.1.0

Description The issue is related to the lack of validation of strings before launching a program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injection attacks via a crafted URL. The problem is associated with the files prefs.c and worldgui.c.

Recommendations For KildClient version 3.1.0, consider validating strings before launching the program specified by the BROWSER environment variable to prevent argument-injection attacks. As a temporary workaround, restrict the use of the BROWSER environment variable until a patch is available.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2017-17511

DLA-1210-1

Produtos afetados

Kildclient

Referências · 10

• https://cve.org/CVERecord?id=CVE-2017-17511 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-17511 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2017/12/msg00013.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-17511 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-17511 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17511 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-17511 · Nota de Segurança
• https://sources.debian.org/src/kildclient/3.1.0-1/src/worldgui.c/?hl=1159#L1159 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17511 · Aviso do Fabricante
• https://sources.debian.org/src/kildclient/3.1.0-1/src/prefs.c/?hl=324#L324 · Nota