Full Disclosure mailing list archives
Re: xdg-open RCE
From: Brandon Perry <bperry.volatile () gmail com>
Date: Fri, 14 Nov 2014 19:59:42 -0600
This is very similar to this gksu bug (which only applies to gksu when in SU_MODE) http://savannah.nongnu.org/bugs/?40023 Attempted to email the gksu 'maintainer', but with no response. Did a quick write up on the Rapid7 site on how I found out about it and the vector I was using to exploit it: https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu Was assigned the following CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2886 On Fri, Nov 14, 2014 at 4:50 PM, joernchen <joernchen () phenoelit de> wrote:
Hi, I just ran into some RCE issue with xdg-open today and figured it's known and unfixed since 2013-06-10 [0] (respectively 2013-07-07 upstream [1]) As apparently noone cares about this I just leave a silly PoC [3] (should work with Chromium on Arch/Gentoo Linux) here. Additional requirement is a Window Manager which is _NOT_ one of the following: * KDE * GNOME * MATE * XFCE * ENLIGHTENMENT Cheers, joernchen [0] https://bugs.gentoo.org/show_bug.cgi?id=472888 [1] https://bugs.freedesktop.org/show_bug.cgi?id=66670 [3] http://phenoelit.org/stuff/xdg-open.html -- joernchen ~ Phenoelit <joernchen () phenoelit de> ~ C776 3F67 7B95 03BF 5344 http://www.phenoelit.de ~ A46A 7199 8B7B 756A F5AC _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
-- http://volatile-minds.blogspot.com -- blog http://www.volatileminds.net -- website _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- xdg-open RCE joernchen (Nov 14)
- Re: xdg-open RCE Brandon Perry (Nov 17)