CVE-2014-4978: Medium severity stormy studios knet vulnerability
The following was reported: ... The function "rsfiltergraph" located in file ./librawstudio/rs-filter.c contains the following code:
gstringappendprintf(str, "}\n"); gfilesetcontents("/tmp/rs-filter-graph", str->str, str->len, NULL);
ignore = system("dot -Tpng >/tmp/rs-filter-graph.png </tmp/rs-filter-graph"); ignore = system("gnome-open /tmp/rs-filter-graph.png");
This code makes insecure use of two temporary files:
/tmp/rs-filter-graph.png /tmp/rs-filter-graph
This allows the truncation of arbitrary files which are owned by the user running rawstudio - for example:
ln -s ~/.important /tmp/rs-filter-graph ln -s /etc/shadow /tmp/rs-filter-graph.png
Other sources
The rsfiltergraph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4978?
CVE-2014-4978 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2014-4978?
To fix CVE-2014-4978, update Rawstudio to version 2.0-1.1 or higher.
Which versions of Rawstudio are affected by CVE-2014-4978?
CVE-2014-4978 affects Rawstudio versions prior to 2.0-1.1.
What systems are impacted by CVE-2014-4978?
CVE-2014-4978 impacts systems running Rawstudio on Debian and Fedora platforms.
Is there any exploit for CVE-2014-4978 available?
Yes, there is potential for exploitation of CVE-2014-4978 through the insecure handling of user input.