Re: was: SA29489 CenterIM URL handling flaw

["Steven M. Christey" <coley () linus mitre org>]

On Tue, 25 Mar 2008, Nico Golde wrote:

> Hi,
> * Nico Golde <oss-security+ml () ngolde de> [2008-03-25 16:25]:
> > * Lubomir Kundrak <lkundrak () redhat com> [2008-03-24 15:08]:
> > > Ad SA29489 [1] "CenterIM URL Parsing Command Execution Vulnerability"
> > >
> > > CenterIM does completely nothing with received URLs. Maybe the
> > > unfortuate "exploit writer" was using XFCE Terminal [2], or a terminal
> > > emulator with a similar problem.
> >
> > That's partly true. While centerim has no special URL
> > handler to handle incoming urls it does provide the ability
> > to list urls in a message by pressing F2. If you press enter
> > on one of these urls it tries to open it in an external
> > browser and executes the other commands as well.

This is the kind of situation that CVE adopted the "user-assisted" term
for: the user assists the attacker in his/her own demise.

> > You see the commands in the URL however so I think the
> > impact of this is like sending someone a message with
> > "please type rm -rf ~ in your shell" so the secunia rating
> > is a bit beyond the actual impact.

Is the URL still encoded at the time it is viewed?  if so, then I don't
expect a typical user to notice this equivalent of "rm -rf *":

  %72%6D%20%2D%72%66%20%2A

and that's part of the "smell test" for user-assisted issues.

Current CVE desc below.

- Steve


======================================================
Name: CVE-2008-1467
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1467
Reference: MILW0RM:5283
Reference: URL:http://www.milw0rm.com/exploits/5283
Reference: BID:28362
Reference: URL:http://www.securityfocus.com/bid/28362
Reference: FRSIRT:ADV-2008-0956
Reference: URL:http://www.frsirt.com/english/advisories/2008/0956/references
Reference: SECUNIA:29489
Reference: URL:http://secunia.com/advisories/29489

** DISPUTED **

CenterIM 4.22.3 and earlier allows user-assisted remote attackers to
execute arbitrary commands via shell metacharacters in a URI, related
to "received URLs in the message window."  NOTE: this issue has been
disputed due to the user-assisted nature, since the URL must be
selected and launched by the victim.