PT-2020-7579 · Libnotify · Libnotify

Published 2020-02-12 · Updated 2020-08-31 · CVE-2013-7381

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libnotify versions 1.0.3 and earlier

Description The issue allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify(). This is a result of a shell command injection vulnerability, where untrusted input passed into libnotify.notify() could result in the execution of shell commands. The callers of libnotify.notify() may be unaware of this risk.

Recommendations Update to version 1.0.4 or greater. As a temporary workaround, consider validating and sanitizing any user input before passing it to libnotify.notify() to minimize the risk of exploitation. Restrict access to the libnotify.notify() function until the issue is resolved by updating to a secure version.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2013-7381

GHSA-6898-WX94-8JQ8

Affected Products

Libnotify

References · 12

• https://github.com/mytrile/node-libnotify/commit/dfe7801d73a0dda10663a0ff3d0ec8b4d5f0d448 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7381 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-7381 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-7381 · Security Note
• https://ubuntu.com/security/CVE-2013-7381 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6898-wx94-8jq8 · Vendor Advisory
• https://github.com/mytrile/node-libnotify · Note
• https://github.com/lloydwatkin/nodesecurity-advisories/blob/master/advisories/libnotify_potential_command_injection_in_libnotify.notify.md · Note
• http://openwall.com/lists/oss-security/2014/05/13/1 · Note
• http://openwall.com/lists/oss-security/2014/05/15/2 · Note
• https://npmjs.com/advisories/20 · Note
• https://nodesecurity.io/advisories/libnotify_potential_command_injection_in_libnotify.notify · Note