oss-security - CVE Request -- tpp: Possibility of arbitrary code execution when processing untrusted TPP template

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 21 Jun 2013 04:09:48 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Axel Beckert <abe@...ian.org>, Nico Golde <nion@...ian.org>,
        "W. Martin Borgert" <debacle@...ian.org>
Subject: CVE Request -- tpp: Possibility of arbitrary code execution when
 processing untrusted TPP template

Hello Kurt, Steve, vendors,

  A security flaw was found in the way tpp, a ncurses-based presentation tool,
processed TPP templates containing --exec clause (input provided as an argument
of the --exec clause would be immediately executed without requesting a second
confirmation from the user). A remote attacker could provide a specially-crafted
text presentation program (TPP) template that, when processed with the tpp binary
would lead to arbitrary code execution with the privileges of the user running
the tpp executable.

References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706644
[2] http://patch-tracker.debian.org/patch/series/view/tpp/1.3.1-3/15-optional-exec.patch
    (Debian distribution patch)
[3] https://bugzilla.redhat.com/show_bug.cgi?id=976684

Upstream patch / GitHub link:
[4] https://github.com/xtaran/tpp/commit/350aafbd9a3256f6d479dacb9740bf3f0b9a3fc3

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.