CVE-2013-7050: Code Injection
A flaw was reported in the uscan script of devscripts:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849
From that bug report:
"" The newfangled debian/copyright-driven repacking can be exploited by malicious upstream to execute arbitrary code. ""
The fix:
http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git;a=commitdiff;h=91f05b5
devscripts is not included in Fedora 18 or 19. It looks to be part of rawhide/the upcoming Fedora 20.
Although some Debian stuff is bundled in the rpmdevtools package, uscan does not appear to be.
Other sources
The getmainsourcedir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCANEXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
devscripts/uscan.plto a version that resolves this vulnerability.Fixed in 2.13.8Patch bug=731849 - Compensating control
devscripts is not included in Fedora 18 or 19.
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7050?
The severity of CVE-2013-7050 is considered moderate due to the potential exploitation of the uscan script in devscripts.
How do I fix CVE-2013-7050?
To fix CVE-2013-7050, update devscripts to version 2.13.8 or later, which addresses the vulnerability.
What software is affected by CVE-2013-7050?
CVE-2013-7050 affects versions of devscripts up to 2.13.7 and includes specific versions from 2.13.0 to 2.13.6.
Can CVE-2013-7050 be exploited remotely?
Yes, CVE-2013-7050 can be exploited by malicious upstream actors, making it a concern for systems using vulnerable versions of devscripts.
Are there any workarounds for CVE-2013-7050?
As a workaround for CVE-2013-7050, ensure to validate upstream software and restrict the use of untrusted sources during script execution.