GLSA-200703-11 : Amarok: User-assisted remote execution of arbitrary code

medium Nessus Plugin ID 24828

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200703-11 (Amarok: User-assisted remote execution of arbitrary code)

The Magnatune downloader doesn't quote the 'm_currentAlbumFileName' parameter while calling the 'unzip' shell command.
Impact :

A compromised or malicious Magnatune server can remotely execute arbitrary shell code with the rights of the user running Amarok on a client that have previously registered for buying music.
Workaround :

Do not use the Magnatune component of Amarok.

Solution

All Amarok users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=media-sound/amarok-1.4.5-r1'

Plugin Details

Severity: Medium

ID: 24828

File Name: gentoo_GLSA-200703-11.nasl

Version: 1.15

Type: local

Family: Gentoo Local Security Checks

Published: 3/16/2007

Updated: 1/6/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:amarok, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Patch Publication Date: 3/13/2007

Reference Information

GLSA: 200703-11

Detections

Analytics