[arch-security] [ASA-201503-23] util-linux: command injection

[Levente Polyak]

Arch Linux Security Advisory ASA-201503-23
==========================================

Severity: Medium
Date    : 2015-03-24
CVE-ID  : CVE-2014-9114
Package : util-linux
Type    : command injection
Remote  : No
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package util-linux before version 2.26.1-3 is vulnerable to command
injection via malicious devices.

Resolution
==========

Upgrade to 2.26.1-3.

# pacman -Syu "util-linux>=2.26.1-3"

The problem has been fixed upstream in version 2.26.

Workaround
==========

None.

Description
===========

There is a command injection inside blkid. It uses caching files
(/dev/.blkid.tab or /run/blkid/blkid.tab) to store info about the UUID,
LABEL etc it finds on certain devices.
However, it does not strip " character, so it can be confused to build
variable names containing embedded shell metas, which it would usually
encode inside the value.

Impact
======

An attacker is able to use a specially prepared device with a malicious
label to potentially inject arbitrary shell commands when mounted with a
wrapper that uses 'blkid -o' passed to eval.

References
==========

http://seclists.org/oss-sec/2014/q4/811
https://access.redhat.com/security/cve/CVE-2014-9114
https://bugs.archlinux.org/task/43886

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150324/e3d9e61d/attachment.asc>