Date: Tue, 11 Nov 2014 20:02:40 +0000 From: Steve Kemp <steve@...ve.org.uk> To: oss-security@...ts.openwall.com Subject: CVE Request - dns-sync node module The dns-sync library for node.js allows resolving hostnames in a synchronous fashion All versions of dns-sync prior to the release 0.1.1 were vulnerable to arbitrary command execution via maliciously formed hostnames. For example: var dnsSync = require('dns-sync'); console.log(dnsSync.resolve('$(id > /tmp/foo)')); This is caused by the hostname being passed through a shell as part of a command execution. I disclosed/reported this here: https://github.com/skoranga/node-dns-sync/issues/1 The following commit resolves the bug: https://github.com/skoranga/node-dns-sync/commit/d9abaae384b198db1095735ad9c1c73d7b890a0d Steve --
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ