FreeWnn jserver JS_MKDIR Metacharacter Command Execution Vulnerability

Bugtraq ID:	3860
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 11 2002 12:00AM
Updated:	Jan 11 2002 12:00AM
Credit:	Disclosed by Shadow Penguin Security on Jan. 11, 2002, in SPS Advisory #44.
Vulnerable:	FreeWnn FreeWnn 1.1 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - HP HP-UX 11.0 - HP HP-UX 10.20 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 6.4 - SuSE Linux 6.3
Not Vulnerable:	FreeWnn FreeWnn 1.1.1 -a017 - Debian Linux 2.2 - Debian Linux 2.1 - FreeBSD FreeBSD 5.0 - FreeBSD FreeBSD 4.0 - HP HP-UX 11.0 - HP HP-UX 10.20 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - NetBSD NetBSD 1.4.2 x86 - NetBSD NetBSD 1.4.1 x86 - SGI IRIX 6.5 - SGI IRIX 6.4 - SGI IRIX 6.3 - SGI IRIX 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 6.4 - SuSE Linux 6.3

FreeWnn jserver JS_MKDIR Metacharacter Command Execution Vulnerability

FreeWnn 1.1.0 is a kana-kanji (japanese) translation system. This software is a client-server type application, with the jserver portion acting as a server and performing translations for clients. The jserver component passes unsanitized input from the client via the JS_MKDIR command to a system() libcall, allowing arbitrary command execution with the semi-colon ";" command separation metacharacter. Commands sent in this manner will be executed at the privilege level of the jserver process.

FreeWnn jserver JS_MKDIR Metacharacter Command Execution Vulnerability

Solution:
This problem is resolved in FreeWnn 1.1.1-a017. A patch for version 1.1.0 is also available.


FreeWnn FreeWnn 1.1

• FreeWnn patch-1.1.0-a01
  ftp://ftp.etl.go.jp/pub/FreeWnn/patch-1.1.0-a01.gz


• FreeWnn FreeWnn-1.1.1-a017
  ftp://ftp.etl.go.jp/pub/FreeWnn/alpha/FreeWnn-1.1.1-a017.tar.gz

FreeWnn jserver JS_MKDIR Metacharacter Command Execution Vulnerability

References:

• freewnn (FreeWnn.org)
  
• SPS Advisory #44 - Wnn jserver JS_MKDIR command vulnerability (Shadow Penguin Security)