The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.

Wesnoth implements a text preprocessing language that is used in conjunction with its own game scripting language. It also has a built-in Lua interpreter and API. Both the Lua API and the preprocessor make use of the same function (filesystem::get_wml_location()) to resolve file paths so that only content from the user's data directory can be read.

However, the function did not explicitly disallow files with the .pbl extension. The contents of these files could thus be stored in saved game files or even transmitted directly to other users in a networked game. Among the information that's compromised is a user-defined passphrase used to authenticate uploads to the game's content server.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Latest upstream.
http://www.openwall.com/lists/oss-security/2015/06/25/2 http://www.openwall.com/lists/oss-security/2015/06/25/2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ignacio R. Morelle reports :

As mentioned in the Wesnoth 1.12.4 and Wesnoth 1.13.1 release announcements, a security vulnerability targeting add-on authors was found (bug #23504) which allowed a malicious user to obtain add-on server passphrases from the client's .pbl files and transmit them over the network, or store them in saved game files intended to be shared by the victim. This vulnerability affects all existing releases up to and including versions 1.12.2 and 1.13.0. Additionally, version 1.12.3 included only a partial fix that failed to guard users against attempts to read from .pbl files with an uppercase or mixed-case extension. CVE-2015-5069 and CVE-2015-5070 have been assigned to the vulnerability affecting .pbl files with a lowercase extension, and .pbl files with an uppercase or mixed-case extension, respectively.

ID	Name	Product	Family	Severity
85585	Debian DLA-297-1 : wesnoth-1.8 security update	Nessus	Debian Local Security Checks	medium
84684	Fedora 21 : wesnoth-1.12.4-1.fc21 (2015-10973)	Nessus	Fedora Local Security Checks	medium
84683	Fedora 22 : wesnoth-1.12.4-1.fc22 (2015-10964)	Nessus	Fedora Local Security Checks	medium
84483	FreeBSD : wesnoth -- disclosure of .pbl files with lowercase, uppercase, and mixed-case extension (2a8b7d21-1ecc-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-5069

medium

Tenable Plugins

medium

medium

medium

medium