CVE-2008-2575: Code Injection
cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a (1) ZIP (aka .cbz) or (2) RAR (aka .cbr) archive filename.
Other sources
Mamoru Tasaka discovered, that cbrpager (Simple comic book pager for Linux) does not properly sanitize file names of the image archives before calling external decompression utilities unrar and unzip using system() libc library call. Opening a .zip or .rar archive with specially crafted filename can result in an execution of the arbitrary code with the privileges of the user running cbrpager.
Sample file name: test";echo owned>bla;".rar (same as for similar issue in comix - https://bugzilla.redhat.com/showbug.cgi?id=430635#c4)
Mamoru's patch accepted by upstream: http://cvs.fedoraproject.org/viewcvs/rpms/cbrpager/devel/cbrpager-0.9.16-filen-shell-escaping.patch?rev=1.2
Fixed upstream in version 0.9.17: http://sourceforge.net/forum/forum.php?forumid=827120 http://www.jcoppens.com/soft/cbrpager/log.en.php
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2575?
CVE-2008-2575 has a medium severity rating due to the potential for arbitrary command execution.
How do I fix CVE-2008-2575?
To fix CVE-2008-2575, upgrade cbrPager to version 0.9.17 or later.
Who is affected by CVE-2008-2575?
CVE-2008-2575 affects users of cbrPager versions prior to 0.9.17 as well as certain versions of Fedora.
What types of files are exploited in CVE-2008-2575?
CVE-2008-2575 can be exploited through ZIP (.cbz) and RAR (.cbr) archive filenames.
Is CVE-2008-2575 a remote vulnerability?
Yes, CVE-2008-2575 is a user-assisted remote vulnerability that can be triggered by opening a malicious file.