KDE Applications 16.12.1 seems to be uploaded to Zesty (excluding PIM)
and it includes Ark 16.12.1, which has this fix baked in.
https://launchpad.net/ubuntu/+source/ark/4:16.12.1-0ubuntu1
I'm marking this as Fix Committed in Zesty, and if someone could mark
this as Fix Released once it gets through to zesty-release, that would
be great. Looks like someone forgot to put this bug number in the
changelog.
** Changed in: ark (Ubuntu Zesty)
Status: Confirmed => Fix Committed
** Description changed:
KDE Project Security Advisory
=============================
Title: Ark: unintended execution of scripts and executable files
Risk Rating: Important
- CVE: TODO
- Platforms: TODO
+ CVE: CVE-2017-5330
Versions: ark >= 15.12
Author: Elvis Angelaccio <elvis.angelac...@kde.org>
- Date: TODO
+ Date: 12 January 2017
Overview
========
Through a (possibly malicious) tar archive that contains an
executable shell script or binary, it was possible to execute
arbitrary code on target machines.
KRun::runUrl() has a runExecutable argument which defaults to true.
Ark was using this default value and was also not checking
whether an extracted file was executable before passing it to the
runUrl() function.
Impact
======
An attacker can send legitimate tar archives with executable scripts or
binaries disguised as normal files (say, with README or LICENSE as filenames).
The attacker then can trick a user to select those files and click
the Open button in the Ark toolbar, which triggers the affected code.
Workaround
==========
- Don't use the Open functionality of Ark.
+ Don't use the File -> Open functionality of Ark.
+ You can still open archives (Archive->Open) and extract them.
Solution
========
Update to Ark >= 16.12.1
For older releases of Ark, apply the following patches:
Applications/16.08 branch:
https://commits.kde.org/ark/49ce94df19607e234525afda5ad4190ce35300c3
Applications/16.04 branch:
https://commits.kde.org/ark/6b6da3f2e6ac5ca12b46d208d532948c1dbb8776
Applications/15.12 branch:
https://commits.kde.org/ark/e2448360eca1b81eb59fffca9584b0fc5fbd8e5b
Credits
=======
Thanks to Fabian Vogt for reporting this issue, Elvis Angelaccio for
fixing this issue.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1655507
Title:
CVE-2017-5330 - Ark: unintended execution of scripts and executable
files
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ark/+bug/1655507/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
