Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4585-1 advisory.

    It was discovered that Newsbeuter didn't handle the command line input properly. An remote attacker could     use it to ran remote code by crafting a special input file. (CVE-2017-12904)

    It was discovered that Newsbeuter didn't handle metacharacters in its filename properly. An remote     attacker could use it to ran remote code by crafting a special filename. (CVE-2017-14500)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for newsbeuter fixes one issues.

This security issue was fixed :

  - CVE-2017-12904: Improper neutralization of special     elements allowed remote attackers to perform     user-assisted code execution by crafting an RSS item     that includes shell code in its title and/or URL     (bsc#1054578).

The remote host is affected by the vulnerability described in GLSA-201801-18 (Newsbeuter: User-assisted execution of arbitrary code)

    Newsbeuter does not properly escape shell meta-characters in the title       and description of RSS feeds when bookmarking.
  Impact :

    A remote attacker, by enticing a user to open a feed with specially       crafted URLs, could possibly execute arbitrary shell commands with the       privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the client machine.

Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the client machine.

For Debian 7 'Wheezy', these problems have been fixed in version 2.5-2+deb7u2.

We recommend that you upgrade your newsbeuter packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
141537	Ubuntu 16.04 LTS : Newsbeuter vulnerabilities (USN-4585-1)	Nessus	Ubuntu Local Security Checks	high
106222	openSUSE Security Update : newsbeuter (openSUSE-2018-62)	Nessus	SuSE Local Security Checks	high
106117	GLSA-201801-18 : Newsbeuter: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
102599	Debian DSA-3947-1 : newsbeuter - security update	Nessus	Debian Local Security Checks	high
102596	Debian DLA-1061-1 : newsbeuter security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-12904

high

Tenable Plugins

high

high

high

high

high