Date: Thu, 25 Apr 2013 12:22:58 -0400 (EDT) From: Jan Lieskovsky <jlieskov@...hat.com> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...us.mitre.org>, William Ting <william.h.ting@...il.com>, Zbigniew Jędrzejewski-Szmek <zbyszek@...waw.pl>, Jan Pokorny <jpokorny@...hat.com>, Thibault North <thibault.north@...il.com> Subject: CVE Request -- autojump: autojump profile will load random stuff from a directory called custom_install Hello Kurt, Steve, vendors, a security flaw was found in the way autojump, a tool for faster filesystem navigation from the command line, used to honour content of custom_install directory when global and local autojump installations were not found, and $SHELL variable was unset or set to different value than bash or zsh. If an unsuspecting autojump user was tricked into running autojump script from the directory a local attacker has write access to, this flaw could be used for arbitrary (Python) code execution with the privileges of the user running the autojump binary / script. Relevant (final) upstream patches are as follows:  https://github.com/joelthelion/autojump/commit/ad09ee27d402be797b3456abff6edeb4291edfec  https://github.com/joelthelion/autojump/commit/c763b2afadb188ab52849c21d43d2e8fe5b8800a References:  https://bugzilla.redhat.com/show_bug.cgi?id=950777 Credit: This issue was found and reported to Red Hat Bugzilla  by Zbigniew Jędrzejewski-Szmek. Thanks also goes to Jan Pokorny for bringing this one to my attention, and to William Ting of autojump upstream for promptly fixing the issue. Could you allocate a CVE identifier for this? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.