osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

The remote host is affected by the vulnerability described in GLSA-201603-02 (OSC: Shell command injection)

    A vulnerability has been discovered that may allow remote attackers to       execute arbitrary commands via shell metacharacters in a _service file.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known work around at this time.

Security fix for CVE-2015-0778

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SUSE Security Update reports :

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

osc was updated to fix a security issue and some non-security bugs.

osc was updated to 0.151.0, fixing the following vulnerability :

  - fixed shell command injection via crafted _service files     CVE-2015-0778 boo#901643

The following non-security bugs were fixed :

  - fix times when data comes from OBS backend

  - support updateing the link in target package for submit     requests

  - various minor bugfixes

ID	Name	Product	Family	Severity
89713	GLSA-201603-02 : OSC: Shell command injection	Nessus	Gentoo Local Security Checks	high
82602	Fedora 20 : osc-0.151.1-163.2.1.fc20 (2015-4549)	Nessus	Fedora Local Security Checks	high
82599	Fedora 21 : osc-0.151.1-163.2.1.fc21 (2015-4482)	Nessus	Fedora Local Security Checks	high
82551	Fedora 22 : osc-0.151.1-163.2.1.fc22 (2015-4687)	Nessus	Fedora Local Security Checks	high
82483	FreeBSD : osc -- shell command injection via crafted _service files (f450587b-d7bd-11e4-b5a4-14dae9d5a9d2)	Nessus	FreeBSD Local Security Checks	high
81799	openSUSE Security Update : osc (openSUSE-2015-224)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-0778

high

Tenable Plugins

high

high

high

high

high

high