Arch Linux alert ASA-201503-23 (util-linux)

From:
    	     
 
Levente Polyak <anthraxx@archlinux.org> 
To:
    	     
 
arch-security@archlinux.org 
Subject:
    	     
 
[ASA-201503-23] util-linux: command injection 
Date:
    	     
 
Tue, 24 Mar 2015 18:25:35 +0100
Message-ID:
    	     
 
<55119E0F.2080301@archlinux.org>
Arch Linux Security Advisory ASA-201503-23
==========================================

Severity: Medium
Date    : 2015-03-24
CVE-ID  : CVE-2014-9114
Package : util-linux
Type    : command injection
Remote  : No
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package util-linux before version 2.26.1-3 is vulnerable to command
injection via malicious devices.

Resolution
==========

Upgrade to 2.26.1-3.

# pacman -Syu "util-linux>=2.26.1-3"

The problem has been fixed upstream in version 2.26.

Workaround
==========

None.

Description
===========

There is a command injection inside blkid. It uses caching files
(/dev/.blkid.tab or /run/blkid/blkid.tab) to store info about the UUID,
LABEL etc it finds on certain devices.
However, it does not strip " character, so it can be confused to build
variable names containing embedded shell metas, which it would usually
encode inside the value.

Impact
======

An attacker is able to use a specially prepared device with a malicious
label to potentially inject arbitrary shell commands when mounted with a
wrapper that uses 'blkid -o' passed to eval.

References
==========

http://seclists.org/oss-sec/2014/q4/811
https://access.redhat.com/security/cve/CVE-2014-9114
https://bugs.archlinux.org/task/43886