acccheck: CVE-2018-12268: Command Injection via shell metacharacters in a username or password file

Debian Bug report logs - #901572
acccheck: CVE-2018-12268: Command Injection via shell metacharacters in a username or password file

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: acccheck: CVE-2018-12268: Command Injection via shell metacharacters in a username or password file

Date: Thu, 14 Jun 2018 23:05:04 +0200

Source: acccheck
Version: 0.2.1-1
Severity: grave
Tags: security upstream

Hi,

The following vulnerability was published for acccheck.

CVE-2018-12268[0]:
| acccheck.pl in acccheck 0.2.1 allows Command Injection via shell
| metacharacters in a username or password file, as demonstrated by
| injection into an smbclient command line.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-12268
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12268

Regards,
Salvatore

Message #10 received at 901572@bugs.debian.org (full text, mbox, reply):

From: phil@reseau-libre.net

To: 901572@bugs.debian.org

Cc: control@bugs.debian.org

Subject: acccheck: CVE-2018-12268: Patch proposal

Date: Mon, 03 Sep 2018 09:25:09 +0200

[Message part 1 (text/plain, inline)]

tags 901572 + patch
user phil@reseau-libre.net
usertags pkg-security-team

thanks

Hello,

I've updated the acccheck.pl behavior to correct (i hope) the 
CVE-2018-12268. User and password input files are sanitized before any 
use in the generated commandline string. The patch is given attached to 
this mail.

Nevertheless, the package doesn't have separated branches for stretch 
and unstable releases, which leads to d/changelog files being denoted as 
targetting for 'unstable' even in the stetch package. In the given 
patch, the only missing point is the "stretch-security" naming of the 
target, as it whould be better to separate into two branches first.

Cheers,
-- 
Philippe Thierry.

[remote_injection_bugfix.debdiff (text/x-diff, attachment)]

Message #17 received at 901572@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>

To: phil@reseau-libre.net

Cc: 901572@bugs.debian.org

Subject: Re: Bug#901572: acccheck: CVE-2018-12268: Patch proposal

Date: Mon, 3 Sep 2018 11:07:08 +0200

Control: affects 904200 acccheck

On Mon, 03 Sep 2018, phil@reseau-libre.net wrote:
> I've updated the acccheck.pl behavior to correct (i hope) the
> CVE-2018-12268. User and password input files are sanitized before any use
> in the generated commandline string. The patch is given attached to this
> mail.

FWIW, I requested the removal of the package a while ago:
https://bugs.debian.org/904200

And this is not the only security issue in that script... there's no point
in spending any time on this issue.

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/

Message #22 received at 901572@bugs.debian.org (full text, mbox, reply):

From: "Phil." <phil@reseau-libre.net>

To: Raphael Hertzog <hertzog@debian.org>,901572@bugs.debian.org

Subject: Re: Bug#901572: acccheck: CVE-2018-12268: Patch proposal

Date: Mon, 03 Sep 2018 12:24:38 +0200

[Message part 1 (text/plain, inline)]

Okay,

From what I've seen, the code is effectively just horrible !

Thanks for adding the affect tag, as I've haven't seen the removal request.

Cheers, 

Le 3 septembre 2018 11:07:08 GMT+02:00, Raphael Hertzog <hertzog@debian.org> a écrit :
>Control: affects 904200 acccheck
>
>On Mon, 03 Sep 2018, phil@reseau-libre.net wrote:
>> I've updated the acccheck.pl behavior to correct (i hope) the
>> CVE-2018-12268. User and password input files are sanitized before
>any use
>> in the generated commandline string. The patch is given attached to
>this
>> mail.
>
>FWIW, I requested the removal of the package a while ago:
>https://bugs.debian.org/904200
>
>And this is not the only security issue in that script... there's no
>point
>in spending any time on this issue.
>
>Cheers,
>-- 
>Raphaël Hertzog ◈ Debian Developer
>
>Support Debian LTS: https://www.freexian.com/services/debian-lts.html
>Learn to master Debian: https://debian-handbook.info/get/

-- 
O Philippe Thierry. 
/Y\/ GPG: 7010 9a3c e210 763e 6341 4581 c257 b91b cdaf c1ea
o#o 

[Message part 2 (text/html, inline)]

Message #27 received at 901572-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 901572-done@bugs.debian.org,

Cc: acccheck@packages.debian.org

Subject: Bug#904200: Removed package(s) from unstable

Date: Tue, 09 Oct 2018 16:42:32 +0000

Version: 0.2.1-3+rm

Dear submitter,

as the package acccheck has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/904200

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Ansgar Burchardt (the ftpmaster behind the curtain)

Send a report that this bug log contains spam.