Bug 1001916 - (CVE-2016-7787) VUL-0: CVE-2016-7787: kdesu: user could sneak an unicode string terminator in the kdesu invocation
(CVE-2016-7787)
VUL-0: CVE-2016-7787: kdesu: user could sneak an unicode string terminator in...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other openSUSE 42.1
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
CVSSv2:RedHat:CVE-2016-7787:6.2:(AV:L...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2016-09-29 11:54 UTC by Mikhail Kasimov
Modified: 2016-12-22 10:59 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mikhail Kasimov 2016-09-29 11:54:34 UTC
References:

[1] http://seclists.org/oss-sec/2016/q3/648
[2] http://seclists.org/oss-sec/2016/q3/653

[1]
==============================================
Hi, Albert from KDE, can we get a CVE assigned for kdesu?

The problem is that you could sneak an unicode string terminator in the kdesu invocation
and the label showing which command will be executed ended there but we did execute the whole thing,
that is,
  
   echo Hi@; whoami > /tmp/filebyroot

If @ is the unicode string terminator would only tell the user kdesu would execute "echo Hi"
but would create the /tmp/filebyroot file as root

The fix is already available at
https://github.com/KDE/kde-cli-tools/commit/5eda179a099ba68a20dc21dc0da63e85a565a171
==============================================

[2]
==============================================
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

    The problem is that you could sneak an unicode string terminator in the kdesu invocation
    and the label showing which command will be executed ended there but we did execute the whole thing,
    that is,

       echo Hi@; whoami > /tmp/filebyroot

    If @ is the unicode string terminator would only tell the user kdesu would execute "echo Hi"
    but would create the /tmp/filebyroot file as root

    The fix is already available at
    https://github.com/KDE/kde-cli-tools/commit/5eda179a099ba68a20dc21dc0da63e85a565a171


Make sure people are not trying to sneak invisible characters on the kdesu label
        kdesu.cpp


Use CVE-2016-7787.

- -- 
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
  http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJX7O5eAAoJEHb/MwWLVhi2ZJYP/3z7JAGJAtY4YkSyMy97A+q/
B5s3hRzWrvpZesyNf80sCuY0PvTnoMiS80nOWYlYVyERbr/1hVh7YQ+GLzpEs/ud
KPhYqhPVNO/tC9ELW1LkAwaYKI4zJXf7yZFIgsuCZI1tgriRf+ehS40eg3tBnCoF
d03nbntQH5ADVZH+KxnnaKMZFfBRQDcMBP7XTcrfXCN5czju13TEWTYKPtL1s4rm
UlyeDQzJ9n+ou6NpNo9HfY+4QILw6mOHrxGl/SczeFgdCCJBwLvXiMAQXi8lLe0z
TmB7eCT1E8Bm7gpGQJUlcoD1PCBRHq1k6hCiTRLupkmYXHGjwWzJRMKqnnG5Stej
0/W5jLd7NQwm003RLwePVWvDw6TVbdZY6tJIMXqkYXc+Qqxx71TtY6/P4U/97Va3
8O8vovP1Xxbui1Xx9dUTU+F/XiG4kjV21XsN+5gAlWFA22v0gGKEvdY4uze5kNH6
dwxj2xTdJKEHIr8cPQeBOBxd46sIChmQWywO9uMMfwUoDS3xHkyq3WkCoI5YalnO
Dx8l5erpytJA8or3hKld0BIk2MTpJI/0zdyl0JqXuleIBjtlAFRMuyclg4n6S9Ek
VXRNWAslPgl+mPquZnyKxCKHfvpgk7ZT5qbU4iqOAv1CabODk+024XrdhHDzCTOQ
/T8u7gshajO1VsGhTTey
=Zeft
-----END PGP SIGNATURE-----

==============================================
Comment 1 Hrvoje Senjan 2016-09-29 14:46:15 UTC
versions >= 5.7.95 have the fix included (either pending, or accepted to Leap 42.2 and TW).
Comment 2 Swamp Workflow Management 2016-09-29 22:00:24 UTC
bugbot adjusting priority
Comment 3 Fabian Vogt 2016-09-30 07:14:35 UTC
Working on it for 42.1.
Comment 4 Bernhard Wiedemann 2016-09-30 08:00:59 UTC
This is an autogenerated message for OBS integration:
This bug (1001916) was mentioned in
https://build.opensuse.org/request/show/431466 42.1 / kde-cli-tools5
Comment 5 Fabian Vogt 2016-10-04 08:02:01 UTC
Ping!
The submit request is now sitting around for over four days, which is especially ironic because I discovered the vulnerability in first place...
Comment 6 Andreas Stieger 2016-10-04 14:32:54 UTC
Also affects:
openSUSE:13.2:Update/kde-cli-tools5
openSUSE:Backports:SLE-12-SP1/kde-cli-tools5

Copied patch, update running. Thanks.
Comment 7 Bernhard Wiedemann 2016-10-04 16:00:48 UTC
This is an autogenerated message for OBS integration:
This bug (1001916) was mentioned in
https://build.opensuse.org/request/show/433168 13.2+42.1+Backports:SLE-12-SP1 / kde-cli-tools5
Comment 8 Swamp Workflow Management 2016-10-11 17:19:55 UTC
openSUSE-SU-2016:2495-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1001916
CVE References: CVE-2016-7787
Sources used:
SUSE Package Hub for SUSE Linux Enterprise 12 (src):    kde-cli-tools5-5.5.5-12.1
Comment 9 Swamp Workflow Management 2016-10-11 17:30:55 UTC
openSUSE-SU-2016:2498-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1001916
CVE References: CVE-2016-7787
Sources used:
openSUSE Leap 42.1 (src):    kde-cli-tools5-5.5.5-18.1
openSUSE 13.2 (src):    kde-cli-tools5-5.3.2-27.1
Comment 10 Marcus Meissner 2016-12-22 10:59:34 UTC
released