[arch-security] [ASA-201503-23] util-linux: command injection
anthraxx at archlinux.org
Tue Mar 24 17:25:35 UTC 2015
Arch Linux Security Advisory ASA-201503-23
Date : 2015-03-24
CVE-ID : CVE-2014-9114
Package : util-linux
Type : command injection
Remote : No
Link : https://wiki.archlinux.org/index.php/CVE
The package util-linux before version 2.26.1-3 is vulnerable to command
injection via malicious devices.
Upgrade to 2.26.1-3.
# pacman -Syu "util-linux>=2.26.1-3"
The problem has been fixed upstream in version 2.26.
There is a command injection inside blkid. It uses caching files
(/dev/.blkid.tab or /run/blkid/blkid.tab) to store info about the UUID,
LABEL etc it finds on certain devices.
However, it does not strip " character, so it can be confused to build
variable names containing embedded shell metas, which it would usually
encode inside the value.
An attacker is able to use a specially prepared device with a malicious
label to potentially inject arbitrary shell commands when mounted with a
wrapper that uses 'blkid -o' passed to eval.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security