Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4585-1 advisory.

    It was discovered that Newsbeuter didn't handle the command line input properly. An remote attacker could     use it to ran remote code by crafting a special input file. (CVE-2017-12904)

    It was discovered that Newsbeuter didn't handle metacharacters in its filename properly. An remote     attacker could use it to ran remote code by crafting a special filename. (CVE-2017-14500)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201803-04 (Newsbeuter: User-assisted execution of arbitrary code)

    Newsbeuter does not properly escape shell meta-characters in an RSS item       with a media enclosure in the podcast playback function of Podbeuter.
  Impact :

    A remote attacker, by enticing a user to open a feed with a specially       crafted media enclosure, could possibly execute arbitrary shell commands       with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

This update for newsbeuter fixes one issues.

This security issue was fixed :

  - CVE-2017-14500: Improper Neutralization of special     elements allowed remote attackers to perform     user-assisted code execution by crafting an RSS item     with a media enclosure that includes shell     metacharacters in its filename (bsc#1059057).

It was discovered that podbeuter, the podcast fetcher in newsbeuter, a text-mode RSS feed reader, did not properly escape the name of the media enclosure (the podcast file), allowing a remote attacker to run an arbitrary shell command on the client machine. This is only exploitable if the file is also played in podbeuter.

For Debian 7 'Wheezy', these problems have been fixed in version 2.5-2+deb7u3.

We recommend that you upgrade your newsbeuter packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that podbeuter, the podcast fetcher in newsbeuter, a text-mode RSS feed reader, did not properly escape the name of the media enclosure (the podcast file), allowing a remote attacker to run an arbitrary shell command on the client machine. This is only exploitable if the file is also played in podbeuter.

ID	Name	Product	Family	Severity
141537	Ubuntu 16.04 LTS : Newsbeuter vulnerabilities (USN-4585-1)	Nessus	Ubuntu Local Security Checks	high
107284	GLSA-201803-04 : Newsbeuter: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
106361	openSUSE Security Update : newsbeuter (openSUSE-2018-92)	Nessus	SuSE Local Security Checks	high
103391	Debian DLA-1104-1 : newsbeuter security update	Nessus	Debian Local Security Checks	high
103311	Debian DSA-3977-1 : newsbeuter - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-14500

high

Tenable Plugins

high

high

high

high

high