Bugzilla – Bug 901643
VUL-0: CVE-2015-0778: osc _service file shell injection
Last modified: 2016-04-27 18:52:25 UTC
add something like this to a _service file and execute osc service run: <param name="pwn">';xterm;'</param>
Created attachment 610425 [details] quick patch, I didn't review all cases
bugbot adjusting priority
ah and name wasn't sanitized either, so you could execute arbitrary commands that way as well (didn't try though)
name doesn't seem to get sanitized on server side either
Created attachment 626334 [details] updated patch any plans to fix this or at least verify whether this is exploitable on server side for a start?
The server side approach is using a save array implementation here. (even though the parameter checks just got improved a bit). So this is a client side/osc issue. It affects users who checkout sources from foreign people with a crafted _service file. security team, do you want to assign a CVE number to this? Otherwise we just release a new osc version these days.
okay, it is also a server side issue. Can you please request a CVE for server and client side aribarity command execution in source service handling of OBS. ?
Please use CVE-2015-0778 for this issue.
osc submissions for SLE 11, 12 and openSUSE 13.1 and 13.2 are out there. Server side parts will be fixed in 2.4.7 2.5.6 2.6.1 releases.
everything went out, including osc to openSUSE:Tools and factory submission. Again, thanks a lot to all of you.
openSUSE-SU-2015:0486-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 901643 CVE References: CVE-2015-0778 Sources used: openSUSE 13.2 (src): osc-0.151.0-8.1 openSUSE 13.1 (src): osc-0.151.0-2.24.1
SUSE-SU-2015:0487-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 901643 CVE References: CVE-2015-0778 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): osc-0.151.0-8.1
public
SUSE-SU-2015:1361-1: An update that solves one vulnerability and has one errata is now available. Category: security (low) Bug References: 901643,936939 CVE References: CVE-2015-0778 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): osc-0.152.0-6.2 SUSE Linux Enterprise Software Development Kit 11-SP3 (src): osc-0.152.0-6.2