aMule 'wxExecute()' Arbitrary Command Execution Vulnerability

Bugtraq ID:	34683
Class:	Input Validation Error
CVE:	CVE-2009-1440
Remote:	Yes
Local:	No
Published:	Apr 22 2009 12:00AM
Updated:	Sep 10 2009 06:41PM
Credit:	Sam Hocevar
Vulnerable:	Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 aMule aMule 2.2.5 aMule aMule 2.2.4 aMule aMule 2.1.2 aMule aMule 0
Not Vulnerable:

aMule 'wxExecute()' Arbitrary Command Execution Vulnerability

aMule is prone to a vulnerability that lets attackers execute arbitrary commands in the context of the vulnerable application.

This issue affects aMule 2.2.4; other versions may also be vulnerable.

UPDATE (June 22, 2009): aMule 2.2.5 is reported vulnerable. Please see the references for more information.

aMule 'wxExecute()' Arbitrary Command Execution Vulnerability

Attackers can use readily available tools to exploit this issue.

aMule 'wxExecute()' Arbitrary Command Execution Vulnerability

Solution:
Updates are available; please see the references for details.

aMule 'wxExecute()' Arbitrary Command Execution Vulnerability

References:

• aMule Home Page (aMule)
  
• Changelog 2.2.5 (aMule)
  
• Debian Bug 525078 insufficient path escaping when opening fies (Sam Hocevar)
  
• Re: already fixed (Sam Hocevar)