PT-2018-15281 · Enlightenment+1 · Terminology+1

Ben N · Published 2018-12-17 · Updated 2024-04-08 · CVE-2018-20167

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Terminology versions prior to 1.3.1

Description The issue allows Remote Code Execution due to the mishandling of popmedia. This can be demonstrated by an unsafe command, such as "cat README.md", when a specific sequence is used. A popmedia control sequence can enable the malicious execution of executable file formats registered in the X desktop share MIME types. The sequence defers unknown file types to the handle unknown media() function, which executes xdg-open against the specified filename. This allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence, for example, through a fake software project. When the control sequence is rendered, the executable file will be run.

Recommendations For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the handle unknown media() function or disabling the execution of unknown file types through xdg-open until a patch is available. Avoid using the xdg-open command for unknown file types in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALT-PU-2018-3681

CVE-2018-20167

MGASA-2019-0031

Affected Products

Alt Linux

Terminology

References · 17

• 🔥 https://phab.enlightenment.org/T7504 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-20167 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0031 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-20167 · Security Note
• https://enlightenment.org/news/2018-12-16-terminology-1.3.1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-20167 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-20167 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20167 · Vendor Advisory
• https://phab.enlightenment.org/rTRM1ac204da9148e7bccb1b5f34b523e2094dfc39e2 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-3681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20167 · Security Note
• https://advisories.mageia.org/MGASA-2019-0031.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20167 · Security Note
• https://ubuntu.com/security/CVE-2018-20167 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=24110 · Note