Project

General

Profile

Bug #299

CVE-2017-17517

Added by Hideki Yamane over 4 years ago. Updated 9 months ago.

Status:
New
Priority:
High
Assignee:
-
Category:
Security
Target version:
-
Start date:
03/21/2018
Due date:
% Done:

0%

Estimated time:

Description

Hi,

I've found CVE was assigned to Sylhpeed at https://security-tracker.debian.org/tracker/CVE-2017-17517

libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.

Perhaps around https://sources.debian.org/src/sylpheed/3.7.0-3/libsylph/utils.c/#L4327 or so.

#1

Updated by Hiroyuki Yamamoto over 4 years ago

Hello,

Hideki Yamane wrote:

I've found CVE was assigned to Sylhpeed at https://security-tracker.debian.org/tracker/CVE-2017-17517

libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.

Perhaps around https://sources.debian.org/src/sylpheed/3.7.0-3/libsylph/utils.c/#L4327 or so.

I'm currently investigating this security advisory.
Currently I think Sylpheed is not vulnerable (unless you intentionally specify a badly implemented command).

Tested with the following examples but no success:

Command:
a) xdg-open '%s' (stock Sylpheed's DEFAULT_BROWSER_CMD)
b) sensible-browser '%s' (Debian-patched Sylpheed's DEFAULT_BROWSER_CMD)

BROWSER=firefox
BROWSER=epiphany
BROWSER=w3m

http://localhost/;ls
http://localhost/';ls%20'/
<a href='http://localhost/";ls'>Link</a>
<a href='http://localhost/";ls /'>Link</a>
<a href='http://localhost/"; ls /'>Link</a>
<a href='http://localhost/" ;ls /'>Link</a>
<a href='http://localhost/ &ls /'>Link</a>

URL strings are passed to the commands as-is, and arguments other than the first one are discarded.
Could you provide some exploits examples? (private e-mail is preferred, if any)

#2

Updated by replica watches 9 months ago

https://www.bestwatchaaa.com/Chopard-replica.html https://www.replicawatchsshop.cc/A.Lange-Sohne-Replica.html https://www.allshopwatch.com/ http://www.classicwatchess.com/ https://www.bestwatchss.com/Chronoswiss-Replica-Watches.html of the https://www.bestwatchaaa.com/U-Boat-replica.html https://www.bestwatchaaa.com/Rolex-replica.html https://www.bestwatchaaa.com/Patek-Philippe-replica.html and https://www.bestwatchss.com/IWC-Replica-Watches.html recognizable fashion brands in the world. https://www.luxuryshopwatch.com/ of the https://www.fakeswatchs.com/ https://www.shopwatchus.com/ purchasing https://www.goodswisswatch.com/ Fake https://www.replicawatchsshop.cc/Piaget-Replica.html https://www.bestwatchss.com/Breitling-Replica-Watches.html https://www.hotwatchsreplica.com/Bell-Ross.html that you can https://www.bestwatchaaa.com/Michele-replica.html less about https://www.bestwatchss.com/Chopard-Replica-Watches.html https://www.replicawatchsshop.cc/Tudor-Replica.html stolen or damaged, as https://www.bestwatchaaa.com/Jacob-Co.-replica.html will have https://www.bestwatchaaa.com/Bell-Ross-replica.html less https://www.hotwatchsreplica.com/Omega.html your https://www.allshopwatch.com/Tissot-a-hot.html and https://www.bestwatchss.com/SevenFriday-Replica-Watches.html https://www.bestwatchaaa.com/Omega-replica.html https://www.bestwatchss.com/Linde-Werdelin-Replica-Watches.html https://www.allshopwatch.com/Casio-a-hot.html replaceable. One https://www.copywatchstyle.com/ https://www.replicawatchsshop.cc/Panerai-Replica.html https://www.replicawatchsshop.cc/Jaeger-LeCoultre-Replica.html https://www.swissrepicass.com/ https://www.bestwatchaaa.com/Seiko-replica.html replicas is that https://www.allshopwatch.com/Harry-Winston-a-hot.html they https://www.replicawatchsshop.cc/Zenith-Replica.html so https://www.allshopwatch.com/Glashutte-a-hot.html https://www.replicawatchsshop.cc/Cartier-Replica.html https://www.bestwatchss.com/Zenith-Replica-Watches.html buy many https://www.hotwatchsreplica.com/Parmigiani.html watches for https://www.allshopwatch.com/Blancpain-a-hot.html https://www.bestwatchss.com/Blancpain-Replica-Watches.html https://www.bestwatchaaa.com/Ulysse-Nardin-replica.html https://www.hotwatchsreplica.com/Chronoswiss.html https://www.bestwatchaaa.com/Romain-Jerome-replica.html item, https://www.allwatchesen.com/ even less, and can https://www.perfectwatchen.com/ https://www.allshopwatch.com/Bedat-Co-a-hot.html style, https://www.bestwatchaaa.com/Tudor-replica.html different https://www.hotwatchsreplica.com/Anonimo.html https://www.bestwatchss.com/Tag-Heuer-Replica-Watches.html different https://www.bestwatchss.com/Perrelet-Replica-Watches.html https://www.allshopwatch.com/Bell-Ross-a-hot.html Buying replica https://www.bestwatchaaa.com/TAG-Heuer-replica.html https://www.bestwatchss.com/Alain-Silberstein-Replica-Watches.html https://www.bestwatchaaa.com/Technomarine-replica.html save https://www.bestwatchaaa.com/Rado-replica.html https://www.bestwatchaaa.com/Movado-replica.html of https://www.hotwatchsreplica.com/girard-perregaux.html and https://www.replicawatchsshop.cc/TAG-Heuer-Replica.html the same https://www.bestwatchaaa.com/Perrelet-replica.html https://www.replicawatchsshop.cc/Corum-Replica.html original watches https://www.bestwatchaaa.com/ our high quality and lowest price of https://www.bestwatchss.com/Vacheron-Constantin-Replica-Watches.html Fake watches.

Also available in: Atom PDF