glsa-201511-01.xml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="201511-01">
  <title>MirBSD Korn Shell: Arbitrary code execution</title>
  <synopsis>An attacker who already had access to the environment could so
    append values to parameters passed through programs.
  </synopsis>
  <product type="ebuild"/>
  <announced>2015-11-02</announced>
  <revised count="2">2015-11-02</revised>
  <bug>524414</bug>
  <access>local</access>
  <affected>
    <package name="app-shells/mksh" auto="yes" arch="*">
      <unaffected range="ge">50c</unaffected>
      <vulnerable range="lt">50c</vulnerable>
    </package>
  </affected>
  <background>
    <p>MirBSD Korn Shell is an actively developed free implementation of the
      Korn Shell programming language and a successor to the Public Domain Korn
      Shell.
    </p>
  </background>
  <description>
    <p>Improper sanitation of environment import allows for appending of values
      to passed parameters. 
    </p>
  </description>
  <impact type="normal">
    <p>An attacker who already had access to the environment could so append
      values to parameters passed through programs (including sudo(8) or
      setuid) to shell scripts, including indirectly, after those programs
      intended to sanitise the environment, e.g. invalidating the last $PATH
      component.
    </p>
  </impact>
  <workaround>
    <p>There is no known workaround at this time.</p>
  </workaround>
  <resolution>
    <p>All mksh users should upgrade to the latest version:</p>
    
    <code>
      # emerge --sync
      # emerge --ask --oneshot --verbose "&gt;=app-shells/mksh-50c"
    </code>
    
  </resolution>
  <references>
    <uri link="https://www.mirbsd.org/permalinks/wlog-10_e20141003-tg.htm#e20141003-tg_wlog-10">
      mksh R50c released, security fix
    </uri>
  </references>
  <metadata tag="requester" timestamp="2014-12-12T08:13:43Z">K_F</metadata>
  <metadata tag="submitter" timestamp="2015-11-02T15:33:07Z">mrueg</metadata>
</glsa>