USN-3584-1: sensible-utils vulnerability

Q: What does an attacker need to exploit this issue?

An attacker needs to cause a user to invoke sensible-browser with a specially crafted URL. The issue could allow argument injection leading to arbitrary code execution.

Q: Who is exposed to this vulnerability?

Systems using Ubuntu's sensible-utils package and the sensible-browser tool may be exposed when users can be directed to attacker-controlled URLs.

Published Feb 26, 2018

Updated

Gabriel Corona discovered that sensible-utils incorrectly validated strings when launcher a browser with the sensible-browser tool. A remote attacker could possibly use this issue with a specially crafted URL to conduct an argument injection attack and execute arbitrary code.

Affected Software

7 affected componentsFixes available

ubuntu/sensible-utils

All of the following

ubuntu/sensible-utils<0.0.10ubuntu0.1

0.0.10ubuntu0.1

Ubuntu Ubuntu=17.10

All of the following

ubuntu/sensible-utils<0.0.9ubuntu0.16.04.1

0.0.9ubuntu0.16.04.1

Ubuntu Ubuntu=16.04

All of the following

ubuntu/sensible-utils<0.0.9ubuntu0.14.04.1

0.0.9ubuntu0.14.04.1

Ubuntu Ubuntu=14.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/sensible-utils to a version that resolves this vulnerability.
Fixed in 0.0.10ubuntu0.1
Upgrade
Upgrade ubuntu/sensible-utils to a version that resolves this vulnerability.
Fixed in 0.0.9ubuntu0.16.04.1
Upgrade
Upgrade ubuntu/sensible-utils to a version that resolves this vulnerability.
Fixed in 0.0.9ubuntu0.14.04.1

Event History

Feb 26, 2018

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2017-17512

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to cause a user to invoke sensible-browser with a specially crafted URL. The issue could allow argument injection leading to arbitrary code execution.

Who is exposed to this vulnerability?

Systems using Ubuntu's sensible-utils package and the sensible-browser tool may be exposed when users can be directed to attacker-controlled URLs.

USN-3584-1: sensible-utils vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed to this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is exposed to this vulnerability?