Bug 1222849 (CVE-2024-32487)

Summary:	VUL-0: CVE-2024-32487: less: mishandling of \n character in paths when LESSOPEN is set leads to OS command execution
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	IN_PROGRESS ---	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	antonio.teixeira, camila.matos, danilo.spinella, sbrabec, yuliu
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/401709/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-32487:8.6:(AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-04-15 13:50:29 UTC

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32487
https://www.cve.org/CVERecord?id=CVE-2024-32487
https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33
http://www.openwall.com/lists/oss-security/2024/04/12/5
http://www.openwall.com/lists/oss-security/2024/04/13/2
https://github.com/gwsw/less/commit/007521ac3c95bc76
https://gitlab.archlinux.org/archlinux/packaging/packages/less/-/commit/1d570db0c84fe95799f460526492e45e24c30ad0
https://bugzilla.redhat.com/show_bug.cgi?id=2274980
https://seclists.org/oss-sec/2024/q2/117

Comment 4 Maintenance Automation 2024-05-06 16:30:11 UTC

SUSE-SU-2024:1534-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1222849
CVE References: CVE-2024-32487
Maintenance Incident: [SUSE:Maintenance:33614](https://smelt.suse.de/incident/33614/)
Sources used:
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 less-530-150000.3.9.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 less-530-150000.3.9.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src):
 less-530-150000.3.9.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 less-530-150000.3.9.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src):
 less-530-150000.3.9.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 less-530-150000.3.9.1
SUSE Enterprise Storage 7.1 (src):
 less-530-150000.3.9.1
SUSE Linux Enterprise Micro 5.1 (src):
 less-530-150000.3.9.1
SUSE Linux Enterprise Micro 5.2 (src):
 less-530-150000.3.9.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src):
 less-530-150000.3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 5 Maintenance Automation 2024-05-07 16:30:05 UTC

SUSE-SU-2024:1550-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1222849
CVE References: CVE-2024-32487
Maintenance Incident: [SUSE:Maintenance:33613](https://smelt.suse.de/incident/33613/)
Sources used:
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 less-458-7.15.1
SUSE Linux Enterprise Server 12 SP5 (src):
 less-458-7.15.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 less-458-7.15.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 6 Maintenance Automation 2024-05-10 12:30:04 UTC

SUSE-SU-2024:1598-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1222849
CVE References: CVE-2024-32487
Maintenance Incident: [SUSE:Maintenance:33612](https://smelt.suse.de/incident/33612/)
Sources used:
openSUSE Leap 15.4 (src):
 less-590-150400.3.9.1
openSUSE Leap Micro 5.3 (src):
 less-590-150400.3.9.1
openSUSE Leap Micro 5.4 (src):
 less-590-150400.3.9.1
openSUSE Leap 15.5 (src):
 less-590-150400.3.9.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src):
 less-590-150400.3.9.1
SUSE Linux Enterprise Micro 5.3 (src):
 less-590-150400.3.9.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src):
 less-590-150400.3.9.1
SUSE Linux Enterprise Micro 5.4 (src):
 less-590-150400.3.9.1
SUSE Linux Enterprise Micro 5.5 (src):
 less-590-150400.3.9.1
Basesystem Module 15-SP5 (src):
 less-590-150400.3.9.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src):
 less-590-150400.3.9.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src):
 less-590-150400.3.9.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src):
 less-590-150400.3.9.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src):
 less-590-150400.3.9.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src):
 less-590-150400.3.9.1
SUSE Manager Proxy 4.3 (src):
 less-590-150400.3.9.1
SUSE Manager Retail Branch Server 4.3 (src):
 less-590-150400.3.9.1
SUSE Manager Server 4.3 (src):
 less-590-150400.3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 9 Stanislav Brabec 2024-05-24 01:34:07 UTC

dspinella leaves SUSE. Taking the package, but I am leaving for vacation. Antonio is a backup.

Comment 12 Stanislav Brabec 2024-06-11 22:07:43 UTC

Fixes were backported to:
SUSE:SLE-15-SP6:Update/less: https://build.suse.de/request/show/335217
SUSE:ALP:Source:Standard:1.0/less: https://build.suse.de/request/show/335218
SUSE:SLFO:Main/less: https://build.suse.de/request/show/335219

Comment 13 Maintenance Automation 2024-06-18 12:30:25 UTC

SUSE-SU-2024:2060-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1222849
CVE References: CVE-2024-32487
Maintenance Incident: [SUSE:Maintenance:34274](https://smelt.suse.de/incident/34274/)
Sources used:
openSUSE Leap 15.6 (src):
 less-643-150600.3.3.1
Basesystem Module 15-SP6 (src):
 less-643-150600.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 15 Stanislav Brabec 2024-06-19 14:59:21 UTC

Everything is done. Just SLFO and ALP packages are still waiting for check-in.

openSUSE:Factory has the version 6.56, which is already fixed.