Snoopy 'exec()' Arbitrary Command Execution Vulnerability

Bugtraq ID:	68419
Class:	Input Validation Error
CVE:	CVE-2014-5008
Remote:	Yes
Local:	No
Published:	Jul 03 2014 12:00AM
Updated:	Oct 26 2016 05:00AM
Credit:	Michail Strokin
Vulnerable:	Snoopy Snoopy 1.2.4 Snoopy Snoopy 1.2.3 Snoopy Snoopy 1.2.1 Snoopy Snoopy 1.2 Snoopy Snoopy 1.0 1 Snoopy Snoopy 0.94 Snoopy Snoopy 0.93 Snoopy Snoopy 0.92 Snoopy Snoopy 0.91 IBM PowerKVM 3.1 IBM PowerKVM 2.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Snoopy 'exec()' Arbitrary Command Execution Vulnerability

Snoopy is prone to a vulnerability that lets attackers execute arbitrary commands because the application fails to properly sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary commands in the context of the vulnerable webserver.

Note: This issue is the result of an incomplete fix for the issue described in BID 31887 (Snoopy '_httpsrequest()' Arbitrary Command Execution Vulnerability).

Snoopy 1.2.4 and prior are vulnerable.

Snoopy 'exec()' Arbitrary Command Execution Vulnerability

An attacker may exploit this issue using a web browser.

Snoopy 'exec()' Arbitrary Command Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Snoopy 'exec()' Arbitrary Command Execution Vulnerability

References:

• Feed2JS/MagpieRSS 0day vulnerability (not really, it is actually CVE-2005-3330 (Michail Strokin)
  
• Snoopy Home Page (Snoopy)
  
• isg3T1024264: Security Bulletin: Vulnerabilities in nagios affect PowerKVM (IBM)