https://bugzilla.redhat.com/show_bug.cgi?id=1526142
Bug ID: 1526142 Summary: CVE-2017-17521 fontforge: Command injetion in help function uiutil.c Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: eng-i18n-bugs@redhat.com, fonts-bugs@lists.fedoraproject.org, kevin@scrye.com, paul@frixxon.co.uk, pnemade@redhat.com
A flaw was found in FontForge through 20170731. uiutil.c does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. A different vulnerability than CVE-2017-17534.
References:
https://security-tracker.debian.org/tracker/CVE-2017-17521
https://bugzilla.redhat.com/show_bug.cgi?id=1526142
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1526144
https://bugzilla.redhat.com/show_bug.cgi?id=1526142
Pedro Yóssis Silva Barbosa pebarbos@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |pebarbos@redhat.com
--- Comment #2 from Pedro Yóssis Silva Barbosa pebarbos@redhat.com --- Created attachment 1375842 --> https://bugzilla.redhat.com/attachment.cgi?id=1375842&action=edit help function calls
Using a crafted URL, it is possible to inject command.
gbg> b *0x56f9bf
gdb> run --help
gbg> printf "%s", $rdi "xdg-open" "http://fontforge.sf.net/overview.html" &
The thing is, though, the URL values seem to be all hardcoded and not possible to craft remotely (see attachment).
https://bugzilla.redhat.com/show_bug.cgi?id=1526142
Pedro Yóssis Silva Barbosa pebarbos@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017 |1214,reported=20171214,sour |1214,reported=20171214,sour |ce=debian,cvss3=5.3/CVSS:3. |ce=debian,cvss3=5.3/CVSS:3. |0/AV:L/AC:L/PR:N/UI:R/S:U/C |0/AV:L/AC:L/PR:N/UI:R/S:U/C |:L/I:L/A:L,cwe=CWE-20,fedor |:L/I:L/A:L,cwe=CWE-20,fedor |a-all/fontforge=affected,rh |a-all/fontforge=affected,rh |el-6/fontforge=new,rhel-7/f |el-6/fontforge=wontfix,rhel |ontforge=new,rhel-8/fontfor |-7/fontforge=wontfix,rhel-8 |ge=affected |/fontforge=affected Last Closed| |2018-01-02 12:42:17
https://bugzilla.redhat.com/show_bug.cgi?id=1526142
--- Comment #3 from Pedro Yóssis Silva Barbosa pebarbos@redhat.com --- Statement:
This issue affects the versions of fontforge as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
https://bugzilla.redhat.com/show_bug.cgi?id=1526142
--- Comment #4 from Parag Nemade pnemade@redhat.com --- Pedro,
Do you still want fedora bug open? I see this got closed as WONTFIX so fedora bug 1526143 should get closed as WONTFIX right?
fonts-bugs@lists.fedoraproject.org