SpeechD Privileged Command Execution Vulnerability
BID:3326
Info
SpeechD Privileged Command Execution Vulnerability
| Bugtraq ID: | 3326 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-0956 |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 11 2001 12:00AM |
| Updated: | Jul 11 2009 07:56AM |
| Credit: | Reported to bugtraq by Tyler Spivey <[email protected]> on September 10, 2001. |
| Vulnerable: |
SpeechIO SpeechD 0.2 SpeechIO SpeechD 0.1 |
| Not Vulnerable: | |
Discussion
SpeechD Privileged Command Execution Vulnerability
SpeechD is a device-independent layer for speech synthesis under Linux, providing an interface for speech-based applications or device drivers.
SpeechD has been found to contain a flaw under certain implementations which can permit a local user to pass malcious commands to the /dev/speech device, and have them executed with the privilege level of the speechd user, which is usually root.
SpeechD is a device-independent layer for speech synthesis under Linux, providing an interface for speech-based applications or device drivers.
SpeechD has been found to contain a flaw under certain implementations which can permit a local user to pass malcious commands to the /dev/speech device, and have them executed with the privilege level of the speechd user, which is usually root.
Exploit / POC
SpeechD Privileged Command Execution Vulnerability
echo "';[hostile shell command]" >/dev/speech
echo "';[hostile shell command]" >/dev/speech
Solution / Fix
SpeechD Privileged Command Execution Vulnerability
Solution:
Find the following line in speechd:
system("$cmd \'$text\'");
and insert the following line directly before it:
$text =~ s/'//g;
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Find the following line in speechd:
system("$cmd \'$text\'");
and insert the following line directly before it:
$text =~ s/'//g;
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.