oss-security - Remote command execution in Ruby Gem ldoce 0.0.2

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 31 Mar 2013 16:11:27 +0000 (GMT)
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Cc: Packet Storm <packet@...ketstormsecurity.org>
Subject: Remote command execution in Ruby Gem ldoce 0.0.2

Remote command execution in Ruby Gem ldoce 0.0.2
Larry W. Cashdollar
@_larry0
3/25/2013

Ldoce Ruby Gem:

Easily interface with the Longman Dictionary of Contemporary English API from Ruby:

NB currently mac only as it depends on the afplay command.

https://github.com/markburns/ldoce

Ldoce passes an mp3 url to commandline for audio output of the pronunciation of a dictonary word:

If the URL or filename for the mp3 files contain shell metacharacters code can be executed remotely as the client:

[./ldoce-0.0.2/lib/ldoce/word.rb]

      if mp3?
        unless File.exists? filename
          command = "curl #{mp3_url} -silent > {filename}"
          `{command}`
        end
        `afplay #{filename}`
      end

Content of type "text/html" skipped

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.