PT-2017-2775 · Newsbeuter+3 · Newsbeuter+3

Jeriko One · Publicado 2017-08-18 · Atualizado 2020-10-21 · CVE-2017-12904

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Newsbeuter versions 0.7 through 2.9

Description The issue is related to improper neutralization of special elements used in an OS command in the bookmarking function. This allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.

Recommendations For Newsbeuter versions 0.7 through 2.9, consider disabling the bookmarking function until a patch is available to prevent exploitation. Restrict access to RSS items that may contain malicious shell code to minimize the risk of code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-943

Identificadores relacionados

ALT-PU-2017-2368

BDU:2017-02033

CVE-2017-12904

DLA-1061-1

DSA-3947-1

OPENSUSE-SU-2018_0166-1

USN-4585-1

Produtos afetados

Alt Linux

Newsbeuter

Suse

Ubuntu

Referências · 18

• https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307 · Correção
• https://github.com/akrennmair/newsbeuter/issues/591 · Nota
• https://osv.dev/vulnerability/ALPINE-CVE-2017-12904 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12904 · Nota de Segurança
• https://security.alpinelinux.org/vuln/CVE-2017-12904 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-12904 · Aviso do Fabricante
• http://debian.org/security/2017/dsa-3947 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02033 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12904 · Aviso do Fabricante
• https://usn.ubuntu.com/4585-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4585-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-14500 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-12904 · Nota de Segurança
• https://groups.google.com/forum/#%21topic/newsbeuter/iFqSE7Vz-DE · Nota
• https://osv.dev/vulnerability/DSA-3947-1 · Aviso do Fabricante