|
|
--nextPart42536873.vzmcopaApC
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Advisory: Perlpodder Remote Arbitrary Command Execution
RedTeam identified a security flaw in perlpodder which makes it possible
for a malicious podcast server to execute arbitrary shell commands on
the victim's client.
Details
======
Product: perlpodder
Affected Versions: All versions up to perlpodder-0.4
=46ixed Versions: perlpodder-0.5
Vulnerability Type: Remote arbitrary command execution
Security-Risk: high
Vendor-URL: http://perlpodder.sourceforge.net/
Vendor-Status: informed, fixed
Advisory-URL: http://www.redteam-pentesting.de/advisories/rt-sa-2006-003.txt
Advisory-Status: public
CVE: GENERIC-MAP-NOMATCH
CVE-URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH
Introduction
===========
Perlpodder is a podcatcher script written in perl. It automates
downloading podcasts.
(from perlpodder SourceForge page)
Podcasting is the distribution of multimedia files over the internet.
Normally, a server is providing an RSS or Atom XML feed describing where
to get the multimedia files. The client parses the feed and may then
download the desired files.
More Details
===========
When perlpodder is used to fetch a podcast, perlpodder will extract the
URL of the audio-file from the XML-file the server provides. The URLs
are saved in the variable "$dlset". There are two occasions in the code
where this variable will be used together with the system() command:
The first usage is with "echo" to log the URL (line 278):
[...]
277 # add urls to log file to mark as retrieved
278 $addurl = "echo " . $dlset . " >> $log_path ";
279 system $addurl;
[...]
The second usage is with "wget" to actually fetch the audio file (line
294):
[...]
291 # Prepair to call wget
292
293 $wget_path = "$cwd". "$datadir" ;
294 $wget_cmd = "wget --quiet --background -o /dev/null -c --tries=2
--timeout=20 --random-wait " . $dlset . " -P ".
$wget_path ;
295
296 if ($DEBUG > 0) {
297
298 print "running " . $wget_cmd . "\n" ;
299
300 }
301
302 system $wget_cmd;
[...]
Unfortunately, $dlset is never properly sanitized, so it is possible for
the remote server to include arbitrary shell commands in the URL which
will then be executed using system() (lines 279 and 302).
Proof of Concept
===============
A minimal malicious server rss feed which exploits the "echo" call may
look as follows: