| 2011-07-15 15:54:27 |
David |
bug |
|
|
added bug |
| 2011-07-15 15:55:17 |
David |
bug task added |
|
foomatic-gui (Ubuntu) |
|
| 2011-07-15 15:55:43 |
David |
affects |
launchpad |
foomatic-filters-ppds |
|
| 2011-07-15 15:56:40 |
David |
foomatic-filters-ppds: status |
New |
Invalid |
|
| 2011-07-15 16:08:45 |
David |
description |
Possible command injection.
The "/usr/lib/python2.6/dist-packages/foomatic/pysmb.py" script which is part of python-foomatic (foomatic-gui depends on this apparently :/) appears that it maybe vulnerable to command injection.
I suspect this because it does _not_ escape the value of a host's 'netbios name' nor the 'workgroup' / domain of the network on line ~118 [0] in the function get_printer_list. I have not checked but I believe this script may be used in the foomatic-gui :/
You can test against the script by doing the following:
#1 installing samba, placing netbios name = oh'notquotezSIF
#2 and then running "python /usr/lib/python2.6/dist-packages/foomatic/pysmb.py"
[0] - for l in os.popen (str, 'r'): |
Possible command injection.
The "/usr/lib/python2.6/dist-packages/foomatic/pysmb.py" script which is part of python-foomatic (foomatic-gui depends on this apparently :/) appears that it maybe vulnerable to command injection.
I suspect this because it does _not_ escape the value of a host's 'netbios name' nor the 'workgroup' / domain of the network on line ~118 [0] in the function get_printer_list. I have not checked but I believe this script may be used in the foomatic-gui :/
You can test against the script by doing the following:
#1 installing samba, placing netbios name = oh'notquotezSIF
#2 and then running "python /usr/lib/python2.6/dist-packages/foomatic/pysmb.py"
[0] - for l in os.popen (str, 'r'): |
|
| 2011-07-15 16:09:36 |
David |
description |
Possible command injection.
The "/usr/lib/python2.6/dist-packages/foomatic/pysmb.py" script which is part of python-foomatic (foomatic-gui depends on this apparently :/) appears that it maybe vulnerable to command injection.
I suspect this because it does _not_ escape the value of a host's 'netbios name' nor the 'workgroup' / domain of the network on line ~118 [0] in the function get_printer_list. I have not checked but I believe this script may be used in the foomatic-gui :/
You can test against the script by doing the following:
#1 installing samba, placing netbios name = oh'notquotezSIF
#2 and then running "python /usr/lib/python2.6/dist-packages/foomatic/pysmb.py"
[0] - for l in os.popen (str, 'r'): |
Possible command injection.
The "/usr/lib/python2.6/dist-packages/foomatic/pysmb.py" script which is part of python-foomatic (foomatic-gui depends on this apparently :/) appears that it maybe vulnerable to command injection.
I suspect this because it does _not_ escape the value of a host's 'netbios name' nor the 'workgroup' / domain of the network on line ~118 [0] in the function get_printer_list. I have not checked but I believe this script may be used in the foomatic-gui :/
You can test against the script by doing the following:
#1 install samba
#2 placing netbios name = oh'notquotezSIF in /etc/samba/smb.conf
#3 restarting samba
#4 run "python /usr/lib/python2.6/dist-packages/foomatic/pysmb.py"
[0] - for l in os.popen (str, 'r'): |
|
| 2011-07-15 16:11:44 |
David |
removed subscriber Launchpad Security |
|
|
|
| 2011-07-15 16:12:04 |
David |
bug |
|
|
added subscriber Ubuntu Security Team |
| 2011-07-15 16:38:07 |
David |
description |
Possible command injection.
The "/usr/lib/python2.6/dist-packages/foomatic/pysmb.py" script which is part of python-foomatic (foomatic-gui depends on this apparently :/) appears that it maybe vulnerable to command injection.
I suspect this because it does _not_ escape the value of a host's 'netbios name' nor the 'workgroup' / domain of the network on line ~118 [0] in the function get_printer_list. I have not checked but I believe this script may be used in the foomatic-gui :/
You can test against the script by doing the following:
#1 install samba
#2 placing netbios name = oh'notquotezSIF in /etc/samba/smb.conf
#3 restarting samba
#4 run "python /usr/lib/python2.6/dist-packages/foomatic/pysmb.py"
[0] - for l in os.popen (str, 'r'): |
Possible command injection.
The "/usr/lib/python2.6/dist-packages/foomatic/pysmb.py" script which is part of python-foomatic (foomatic-gui depends on this apparently :/) appears that it maybe vulnerable to command injection.
I suspect this because it does _not_ escape the value of a host's 'netbios name' nor the 'workgroup' / domain of the network on line ~118 [0] in the function get_printer_list. I have not checked but I believe this script may be used in the foomatic-gui :/
You can test against the script by doing the following:
#1 install samba
#2 add netbios name = oh'notquotezSIF to /etc/samba/smb.conf
#3 restart samba
#4 run "python /usr/lib/python2.6/dist-packages/foomatic/pysmb.py"
[0] - for l in os.popen (str, 'r'): |
|
| 2011-07-30 16:09:48 |
David |
summary |
python-foomatic Possible command injection. |
python-foomatic command injection. |
|
| 2011-07-30 16:09:55 |
David |
description |
Possible command injection.
The "/usr/lib/python2.6/dist-packages/foomatic/pysmb.py" script which is part of python-foomatic (foomatic-gui depends on this apparently :/) appears that it maybe vulnerable to command injection.
I suspect this because it does _not_ escape the value of a host's 'netbios name' nor the 'workgroup' / domain of the network on line ~118 [0] in the function get_printer_list. I have not checked but I believe this script may be used in the foomatic-gui :/
You can test against the script by doing the following:
#1 install samba
#2 add netbios name = oh'notquotezSIF to /etc/samba/smb.conf
#3 restart samba
#4 run "python /usr/lib/python2.6/dist-packages/foomatic/pysmb.py"
[0] - for l in os.popen (str, 'r'): |
The "/usr/lib/python2.6/dist-packages/foomatic/pysmb.py" script which is part of python-foomatic (foomatic-gui depends on this apparently :/) appears that it maybe vulnerable to command injection.
I suspect this because it does _not_ escape the value of a host's 'netbios name' nor the 'workgroup' / domain of the network on line ~118 [0] in the function get_printer_list. I have not checked but I believe this script may be used in the foomatic-gui :/
You can test against the script by doing the following:
#1 install samba
#2 add netbios name = oh'notquotezSIF to /etc/samba/smb.conf
#3 restart samba
#4 run "python /usr/lib/python2.6/dist-packages/foomatic/pysmb.py"
[0] - for l in os.popen (str, 'r'): |
|
| 2011-07-30 17:07:02 |
David |
visibility |
private |
public |
|
| 2011-08-03 13:13:56 |
Marc Deslauriers |
foomatic-gui (Ubuntu): status |
New |
Confirmed |
|
| 2011-08-03 13:13:58 |
Marc Deslauriers |
foomatic-gui (Ubuntu): importance |
Undecided |
High |
|
| 2011-08-18 13:13:17 |
Jeremy Visser |
bug |
|
|
added subscriber Jeremy Visser |
| 2011-09-01 17:31:32 |
Jamie Strandboge |
foomatic-gui (Ubuntu): status |
Confirmed |
Fix Released |
|
