Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5222 > unrolled thread

Fwd: Re: [scr330159] lintian - 2.5.41, not fixed yet

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Fwd: Re: [scr330159] lintian - 2.5.41, not fixed yet Niels Thykier <niels@thykier.net> - 2017-05-08 08:00 +0200
    Re: Fwd: Re: [scr330159] lintian - 2.5.41, not fixed yet Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2017-05-08 22:50 +0200

#5222 — Fwd: Re: [scr330159] lintian - 2.5.41, not fixed yet

#861958 is now known as CVE-2017-8829 per following mail from
cve-request@mitre.org.



-------- Forwarded Message --------
Subject: Re: [scr330159] lintian - 2.5.41, not fixed yet
Date: Sun, 7 May 2017 23:06:53 -0400
From: cve-request@mitre.org
To: niels@thykier.net
CC: cve-request@mitre.org

> [Suggested description]
> Deserialization vulnerability in lintian through 2.5.50.3
> allows attackers to trigger code execution by requesting a review of
> a source package with a crafted YAML file.
> 
> ------------------------------------------
> 
> [Additional Information]
> The issue is already public. It affects Debian unstable (development),
> testing (development) and stable-backports plus Ubuntu xenial,
> yakkety, zesty, artful (development). Other Debian-based distros may
> be affected as well. This product is maintained at
> https://anonscm.debian.org/cgit/lintian/lintian.git
> 
> ------------------------------------------
> 
> [VulnerabilityType Other]
> Code execution via YAML deserialization
> 
> ------------------------------------------
> 
> [Vendor of Product]
> Debian, Ubuntu
> 
> ------------------------------------------
> 
> [Affected Product Code Base]
> lintian - 2.5.41, not fixed yet
> 
> ------------------------------------------
> 
> [Attack Type Other]
> Needs to make victim run lintian on source package with crafted YAML file
> 
> ------------------------------------------
> 
> [Impact Code execution]
> true
> 
> ------------------------------------------
> 
> [Attack Vectors]
> Needs to make victim run lintian on source package with crafted YAML file
> 
> ------------------------------------------
> 
> [Reference]
> https://bugs.debian.org/861958
> 
> ------------------------------------------
> 
> [Has vendor confirmed or acknowledged the vulnerability?]
> true
> 
> ------------------------------------------
> 
> [Discoverer]
> Jakub Wilk (Debian)

Use CVE-2017-8829.

[toc] | [next] | [standalone]

#5223

[Multipart message — attachments visible in raw view] — view raw

Niels Thykier wrote...

> > Deserialization vulnerability in lintian through 2.5.50.3
> > allows attackers to trigger code execution by requesting a review of
> > a source package with a crafted YAML file.

In my opinion lintian is just the victim of an issue in the YAML::XS
module (libyaml-libyaml-perl) where serialized objects are
re-instantiatiated unconditionally. To resolve that problem, I've
started a discussion on the debian-perl@ list.

    Christoph

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web