PT-2008-1120 · Xdg-Utils · Xdg-Utils

Published 2008-01-30 · Updated 2024-06-15 · CVE-2008-0386

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xdg-utils versions 1.0.2 and earlier

Description The issue allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.

Recommendations For versions 1.0.2 and earlier, consider disabling the xdg-open and xdg-email functions until a patch is available to prevent the execution of arbitrary commands via shell metacharacters in URL arguments.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-09624

CVE-2008-0386

OPENSUSE-SU-2024:11518-1

Affected Products

Xdg-Utils

References · 23

• 🔥 http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?r1=1.24&r2=1.25 · Exploit
• 🔥 http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open.in?r1=1.17&r2=1.18 · Exploit
• 🔥 http://bugs.gentoo.org/show_bug.cgi?id=207331 · Exploit
• 🔥 http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open?r1=1.32&r2=1.33 · Exploit
• 🔥 http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email?r1=1.36&r2=1.37 · Exploit
• 🔥 http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?view=log · Exploit
• https://bdu.fstec.ru/vul/2015-09624 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2008:031 · Vendor Advisory
• http://secunia.com/advisories/28638 · Vendor Advisory
• http://secunia.com/advisories/28728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0386 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11518-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200801-21.xml · Vendor Advisory
• http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open?view=log · Note