Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Back In Time: Command injection
Informations
Name GLSA-201801-06 First vendor Publication 2018-01-07
Vendor Gentoo Last vendor Modification 2018-01-07
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis


========


 


A command injection vulnerability in 'Back in Time' may allow for the


execution of arbitrary shell commands.


 


Background


==========


 


A simple backup tool for Linux, inspired by "flyback project".


 


Description


===========


 


'Back in Time' did improper escaping/quoting of file paths used as


arguments to the 'notify-send' command leading to some parts of file


paths being executed as shell commands within an os.system call.


 


Impact


======


 


A context-dependent attacker could execute arbitrary shell commands via


a specially crafted file.


 


Workaround


==========


 


There is no known workaround at this time.


 


Resolution


==========


 


All 'Back In Time' users should upgrade to the latest version:


 



# emerge --sync



# emerge --ask --oneshot --verbose ">=app-backup/backintime-1.1.24"


 


References


==========


 


[ 1 ] CVE-2017-16667


https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-16667


 


Availability


============


 


This GLSA and any updates to it are available for viewing at


the Gentoo Security Website:


 


https://security.gentoo.org/glsa/201801-06


 


Original Source

Url : http://security.gentoo.org/glsa/glsa-201801-06.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-78 Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

Nessus® Vulnerability Scanner

Date Description
2018-01-15 Name : The remote Fedora host is missing a security update.
File : fedora_2017-898a922aff.nasl - Type : ACT_GATHER_INFO
2018-01-08 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201801-06.nasl - Type : ACT_GATHER_INFO
2017-11-27 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2017-1309.nasl - Type : ACT_GATHER_INFO
2017-11-21 Name : The remote Fedora host is missing a security update.
File : fedora_2017-8016cc0bd0.nasl - Type : ACT_GATHER_INFO
2017-11-20 Name : The remote Fedora host is missing a security update.
File : fedora_2017-ebee750022.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2018-01-08 05:19:57
  • First insertion