Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE Request: colord sql injections
From: Kurt Seifried <kseifried () redhat com>
Date: Fri, 25 Nov 2011 09:50:49 -0700

On 11/25/2011 08:13 AM, Jan Lieskovsky wrote:
Hi Ludwig,

  thank you for the report.

On 11/25/2011 11:55 AM, Ludwig Nussel wrote:

colord did not quote user supplied strings which made it prone to
SQL injections:

Just to have this one sorted out wrt to the patches, the relevant
upstream patches are these two:


Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

When colord runs as root and local active users are allowed to
create new devices (both are the defaults AFAIK) this allows not
only to corrupt colord's own database but also to leverage it to
modify other databases in the system (PackageKit for example also
uses sqlite).

PoC available on request.


Please use CVE-2011-4349 for these SQL injection issues.


-Kurt Seifried / Red Hat Security Response Team

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]