Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified,     allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
    (CVE-2014-9622)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201701-09 (Xdg-Utils: Command injection)

    An eval injection vulnerability was discovered in Xdg-Utils.
  Impact :

    A context-dependent attacker could execute arbitrary code via the URL       argument to xdg-open.
  Workaround :

    There is no known workaround at this time.

This update fixes the following security issue :

  - Fix Remote code execution in xdg-open due to bad quotes     handling CVE-2014-9622 (bnc#913676).

John Houwer discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely.

ID	Name	Product	Family	Severity
218452	Linux Distros Unpatched Vulnerability : CVE-2014-9622	Nessus	Misc.	critical
96240	GLSA-201701-09 : Xdg-Utils: Command injection	Nessus	Gentoo Local Security Checks	medium
81140	openSUSE Security Update : xdg-utils (openSUSE-SU-2015:0191-1)	Nessus	SuSE Local Security Checks	medium
80833	Debian DSA-3131-1 : xdg-utils - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-9622

critical

Tenable Plugins

critical

medium

medium

medium