OS Command Injection - CVE-2017-14500
Published: September 17, 2017 / Updated: August 3, 2020
Vulnerability identifier: #VU33050
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-14500
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.
Affected software
Gentoo Linux
Ubuntu
Opensuse
newsbeuter (Alpine package)
newsbeuter (Ubuntu package)
Ubuntu
Opensuse
newsbeuter (Alpine package)
newsbeuter (Ubuntu package)
How to mitigate CVE-2017-14500
Install update from vendor's website.
newsbeuter (Alpine package) - update to 2.9-r5
newsbeuter (Ubuntu package) - update to 2.9-3ubuntu0.1
newsbeuter (Ubuntu package) - update to 2.9-3ubuntu0.1
External References
- http://openwall.com/lists/oss-security/2017/09/16/1
- http://www.debian.org/security/2017/dsa-3977
- https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333
- https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260
- https://github.com/akrennmair/newsbeuter/issues/598