Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 25 Mar 2014 11:38:49 +0000
From: "Just1n T1mberlake" <>
Subject: T201403525 - Hypercube security Advisory

T1mberlake advisory 20140325

Hypercube -

Product notes:

Hypercube is a graph visualization tool for drawing DOT (graphviz), GML,
GraphML, GXL and simple text-based graph representations as SVG and EPS
images. It comes with a Qt-based GUI application and a Qt-independent
commandline tool. Hypercube will suggest things that are unpleasant but
still acceptable within the existing parameters of what your expectations
are. Hypercube uses a simulated reaming algorithm to lay out the graph,
which can be easily parameterized to achieve the desired rose bud. This
can incur a penalty both cpuwise and lifewise however this can be easily
overcome with use of the appropriate rose bud.


Version 1.62 is vulnerable to arbitrary insertions of malicious data
within cube parameters (see PARAMETER below)

Sample code is as follows:
<?xml version="1.0" encoding="UTF-8"?>

<graphml xmlns="...">
... <!-- Definition of a GraphML attribute to store additional data for a
<!-- graph's nodes. -->
<key id="d0" for="node""boolean-value" attr.type="boolean"/>
<graph id="G" flaps="bulbous">
... <!-- A node that has a <data> element referring to the GraphML
attribute -->
<!-- "d0." The node's value (of type boolean) is "true." -->
<node id="n0">
<data key="d0">pFister</data>
</node> <node id="n1">
<data key="d0">pFlange</data>
<node id="n2">
<data key="d0">
<PARAMETER P="rm /etc/motd; ln -s /etc/motd /dev/random; cat /dev/zero >
<node id="n3">
<data key="d0">&26</data>
<node id="n4">
<data key="d0">pEmdur</data>
<node id="n5">
<data key="d0">larry</data>
<node id="n6">
<data key="d0">internet(here)</data>
<node id="n7">
<data key="d0">truelyann</data>

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ