backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft an unreadable file with a specific name to run arbitrary shell commands.

- update to fix CVE-2017-16667

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201801-06 (Back In Time: Command injection)

    &lsquo;Back in Time&rsquo; did improper escaping/quoting of file paths used as       arguments to the &lsquo;notify-send&rsquo; command leading to some parts of file       paths being executed as shell commands within an os.system call.
  Impact :

    A context-dependent attacker could execute arbitrary shell commands via       a specially crafted file.
  Workaround :

    There is no known workaround at this time.

This update for backintime fixes the following issues :

Security issue fixed :

  - CVE-2017-16667: Fixed shell injection in notify-send     (boo#1067342).

ID	Name	Product	Family	Severity
105923	Fedora 27 : backintime (2017-898a922aff)	Nessus	Fedora Local Security Checks	high
105632	GLSA-201801-06 : Back In Time: Command injection	Nessus	Gentoo Local Security Checks	high
104772	openSUSE Security Update : backintime (openSUSE-2017-1309)	Nessus	SuSE Local Security Checks	high
104711	Fedora 25 : backintime (2017-8016cc0bd0)	Nessus	Fedora Local Security Checks	high
104692	Fedora 26 : backintime (2017-ebee750022)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-16667

high

Tenable Plugins

high

high

high

high

high