Mumbles Firefox Plugin Remote Arbitrary Shell Command Injection Vulnerability

Bugtraq ID:	35640
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 11 2009 12:00AM
Updated:	Apr 13 2015 09:41PM
Credit:	Tim Waugh
Vulnerable:	Mumbles Mumbles 0.4
Not Vulnerable:

Mumbles Firefox Plugin Remote Arbitrary Shell Command Injection Vulnerability

Mumbles is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data. The issue affects the Firefox plugin.

Remote attackers may be able to exploit this issue to execute arbitrary shell commands with the privileges of the user running the application.

Mumbles 0.4 is vulnerable; other versions may also be affected.

Mumbles Firefox Plugin Remote Arbitrary Shell Command Injection Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Mumbles Firefox Plugin Remote Arbitrary Shell Command Injection Vulnerability

Solution:
Fixes are available. Please see the references for details.

Mumbles Firefox Plugin Remote Arbitrary Shell Command Injection Vulnerability

References:

• Bug 479171 - Unsafe shell usage (Red Hat)
  
• Mumbles Homepage (Mumbles)