Arch Linux Security Advisory ASA-201711-40 ========================================== Severity: High Date : 2017-11-30 CVE-ID : CVE-2017-15924 Package : shadowsocks-libev Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-474 Summary ======= The package shadowsocks-libev before version 3.1.1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 3.1.1-1. # pacman -Syu "shadowsocks-libev>=3.1.1-1" The problem has been fixed upstream in version 3.1.1. Workaround ========== None. Description =========== In manager.c in ss-manager in shadowsocks-libev before 3.1.1, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions. Impact ====== A local attacker could send a specially crafted configuration request to localhost that, when processed by ss-manager, leads to the execution of arbitrary commands as the user running ss-manager. References ========== http://openwall.com/lists/oss-security/2017/10/13/2 https://github.com/shadowsocks/shadowsocks-libev/commit/c67d275803dc6ea22c55... https://github.com/shadowsocks/shadowsocks-libev/issues/1734 https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/ https://security.archlinux.org/CVE-2017-15924