The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."

- added weechat-fix-hook_process-shell-injection.patch     which fixes a shell injection vulnerability in the     hook_process function (bnc#790217, CVE-2012-5534)

  - added     weechat-fix-buffer-overflow-in-irc-color-decoding.patch     which fixes a heap-based overflow when decoding IRC     colors in strings (bnc#789146, CVE-2012-5854)

The remote host is affected by the vulnerability described in GLSA-201405-03 (WeeChat: Multiple vulnerabilities)

    Two vulnerabilities have been discovered in WeeChat:
      The hook_process() function does not properly handle shell expansions         (CVE-2012-5534).
      WeeChat does not properly decode colors which could cause a         heap-based buffer overflow (CVE-2012-5854).
  Impact :

    A remote attacker could entice a user to open a specially crafted script       or send messages with specially crafted colors, possibly resulting in       execution of arbitrary code with the privileges of the process, or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Updated weechat packages fix security vulnerability :

A buffer overflow is causing a crash or freeze of WeeChat (0.36 to 0.39) when decoding IRC colors in strings. The packages have been patched to fix this problem (CVE-2012-5854).

Untrusted command for function hook_process in WeeChat before 0.3.9.2 could lead to execution of commands, because of shell expansions (so the problem is only caused by some scripts, not by WeeChat itself) (CVE-2012-5534).

Two security issues have been discovered in WeeChat, a fast, light and extensible chat client :

  - CVE-2011-1428     X.509 certificates were incorrectly validated.

  - CVE-2012-5534     The hook_process function in the plugin API allowed the     execution of arbitrary shell commands.

New upstream version Fix arbitrary code execution due to call of shell when executing command within hook_process Fix the security bug in the linked Bugzilla.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix arbitrary code execution due to call of shell when executing command within hook_process

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74822	openSUSE Security Update : weechat (openSUSE-SU-2012:1580-1)	Nessus	SuSE Local Security Checks	high
73859	GLSA-201405-03 : WeeChat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
66148	Mandriva Linux Security Advisory : weechat (MDVSA-2013:136)	Nessus	Mandriva Local Security Checks	high
63383	Debian DSA-2598-1 : weechat - several vulnerabilities	Nessus	Debian Local Security Checks	high
63237	Fedora 18 : weechat-0.3.9.2-2.fc18 (2012-19588)	Nessus	Fedora Local Security Checks	high
63236	Fedora 16 : weechat-0.3.9.2-2.fc16 (2012-19538)	Nessus	Fedora Local Security Checks	high
63212	Fedora 17 : weechat-0.3.9.2-2.fc17 (2012-19533)	Nessus	Fedora Local Security Checks	high
63088	Fedora 16 : weechat-0.3.8-4.fc16 (2012-18575)	Nessus	Fedora Local Security Checks	high
63086	Fedora 17 : weechat-0.3.8-4.fc17 (2012-18526)	Nessus	Fedora Local Security Checks	high
63052	Fedora 18 : weechat-0.3.8-4.fc18 (2012-18494)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2012-5534

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high