Renattach Potential Command Execution Vulnerability

Bugtraq ID:	11356
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 03 2004 12:00AM
Updated:	Oct 03 2004 12:00AM
Credit:	This issue was disclosed in the product's change log.
Vulnerable:	renattach renattach 1.2.1 renattach renattach 1.2
Not Vulnerable:	renattach renattach 1.2.2 renattach renattach 1.2.1 e

Renattach Potential Command Execution Vulnerability

renattach is reported prone to a potential command execution vulnerability. renattach employs the popen() function to direct output to an external command. This functionality is used to provided that '--pipe' or '-p' facility through the command line.

Reportedly, renattach filters shell characters from the command line, however, this is a potential for arbitrary command execution.

renattach 1.2.0 and 1.2.1 are reported prone to this issue.

Renattach Potential Command Execution Vulnerability

No exploit is required.

Renattach Potential Command Execution Vulnerability

Solution:
The vendor has released renattach beta version 1.2.1e and 1.2.2 stable to address this issue.


renattach renattach 1.2

• renattach renattach-1.2.2.tar.gz
  http://freshmeat.net/redir/renattach/8951/url_tgz/renattach-1.2.2.tar. gz

renattach renattach 1.2.1

• renattach renattach-1.2.2.tar.gz
  http://freshmeat.net/redir/renattach/8951/url_tgz/renattach-1.2.2.tar. gz

Renattach Potential Command Execution Vulnerability

References:

• renattach project page (renattach)
  
• Security fixes in renattach 1.2.1e (renattach)