CVE-2011-4195: Other (NVD-CWE-Other)
value: kiwi before 4.98.05, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in an image name.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2014-04-16T18:37Z
Repository: https://github.com/openSUSE/kiwi
Language: Perl
Files changed: modules/KIWIBoot.pm, modules/KIWIImage.pm
Commit date: 2011-10-27 12:07:41 +0200
Commit message: - fixed quoting of parameters in config.isoclient

Diff: diff --git a/modules/KIWIBoot.pm b/modules/KIWIBoot.pm
index 6add24199..8f287882e 100644
--- a/modules/KIWIBoot.pm
+++ b/modules/KIWIBoot.pm
@@ -919,11 +919,11 @@ sub setupInstallCD {
 		if (! open (FD,">$tmpdir/config.isoclient")) {
 			$kiwi -> error  ("Couldn't create CD install flag file");
 			$kiwi -> failed ();
 			return undef;
 		}
-		print FD "IMAGE=$namecd\n";
+		print FD "IMAGE='".$namecd."'\n";
 		close FD;
 		$kiwi -> info ("Importing system image: $system");
 		$status = qxx ("mv $system $tmpdir 2>&1");
 		$result = $? >> 8;
 		if ($result != 0) {
@@ -1487,11 +1487,11 @@ sub setupInstallStick {
 			$kiwi -> error  ("Couldn't create USB install flag file");
 			$kiwi -> failed ();
 			$this -> cleanLoop ();
 			return undef;
 		}
-		print FD "IMAGE=$nameusb\n";
+		print FD "IMAGE='".$nameusb."'\n";
 		close FD;
 		$main::global -> umount();
 		$kiwi -> done();
 	}
 	#==========================================
@@ -2570,11 +2570,11 @@ sub setupInstallFlags {
 			$kiwi -> error  ("Couldn't find md5 file");
 			$kiwi -> failed ();
 			qxx ("rm -rf $irddir");
 			return undef;
 		}
-		print FD "IMAGE=$namecd\n";
+		print FD "IMAGE='".$namecd."'\n";
 		close FD;
 	}
 	#==========================================
 	# create new initrd with vmxsystem file
 	#------------------------------------------
diff --git a/modules/KIWIImage.pm b/modules/KIWIImage.pm
index aa2ddae93..d82415be5 100644
--- a/modules/KIWIImage.pm
+++ b/modules/KIWIImage.pm
@@ -1929,19 +1929,19 @@ sub createImageLiveCD {
 		$kiwi -> error  ("Couldn't create image boot configuration");
 		$kiwi -> failed ();
 		return undef;
 	}
 	if ((! defined $gzip) || ($gzip =~ /^(unified|clic)/)) {
-		print FD "IMAGE=/dev/ram1;$namecd\n";
+		print FD "IMAGE='/dev/ram1;$namecd'\n";
 	} else {
-		print FD "IMAGE=/dev/loop1;$namecd\n";
+		print FD "IMAGE='/dev/loop1;$namecd'\n";
 	}
 	if (defined $gzip) {
 		if ($gzip =~ /^unified/) {
-			print FD "UNIONFS_CONFIG=/dev/ram1,/dev/loop1,aufs\n";
+			print FD "UNIONFS_CONFIG='/dev/ram1,/dev/loop1,aufs'\n";
 		} elsif ($gzip =~ /^clic/) {
-			print FD "UNIONFS_CONFIG=/dev/ram1,/dev/loop1,clicfs\n";
+			print FD "UNIONFS_CONFIG='/dev/ram1,/dev/loop1,clicfs'\n";
 		} else {
 			print FD "COMBINED_IMAGE=yes\n";
 		}
 	}
 	close FD;
@@ -2883,21 +2883,21 @@ sub writeImageConfig {
 		}
 		#==========================================
 		# IMAGE information
 		#------------------------------------------
 		if (($type{compressed}) && ($type{compressed} eq 'true')) {
-			print FD "IMAGE=${device}${targetPartition};";
-			print FD "$namecd;$server;$blocks;compressed";
+			print FD "IMAGE='${device}${targetPartition};";
+			print FD "$namecd;$server;$blocks;compressed'";
 			if ("$type{type}" eq "split" && defined $this->{imageTreeRW}) {
 				print FD ",${device}${targetPartitionNext}";
 				print FD ";$namerw;$server;$blocks;compressed\n";
 			} else {
 				print FD "\n";
 			}
 		} else {
-			print FD "IMAGE=${device}${targetPartition};";
-			print FD "$namecd;$server;$blocks";
+			print FD "IMAGE='${device}${targetPartition};";
+			print FD "$namecd;$server;$blocks'";
 			if ("$type{type}" eq "split" && defined $this->{imageTreeRW}) {
 				print FD ",${device}${targetPartitionNext}";
 				print FD ";$namerw;$server;$blocks\n";
 			} else {
 				print FD "\n";
@@ -2933,11 +2933,11 @@ sub writeImageConfig {
 			if (($unionConfig{rw}) && ($unionConfig{ro})) {
 				$value = "$unionConfig{rw},$unionConfig{ro},$unionConfig{type}";
 				$valid = 1;
 			}
 			if ($valid) {
-				print FD "UNIONFS_CONFIG=$value\n";
+				print FD "UNIONFS_CONFIG='".$value."'\n";
 			}
 		}
 		#==========================================
 		# KIWI_BOOT_TIMEOUT information
 		#------------------------------------------

Vulnerable code: 		print FD "IMAGE=$namecd\n";
		print FD "IMAGE=$nameusb\n";
		print FD "IMAGE=$namecd\n";
		print FD "IMAGE=/dev/ram1;$namecd\n";
		print FD "IMAGE=/dev/loop1;$namecd\n";
			print FD "UNIONFS_CONFIG=/dev/ram1,/dev/loop1,aufs\n";
			print FD "UNIONFS_CONFIG=/dev/ram1,/dev/loop1,clicfs\n";
			print FD "IMAGE=${device}${targetPartition};";
			print FD "$namecd;$server;$blocks;compressed";
			print FD "IMAGE=${device}${targetPartition};";
			print FD "$namecd;$server;$blocks";
				print FD "UNIONFS_CONFIG=$value\n";
Fixed code: 		print FD "IMAGE='".$namecd."'\n";
		print FD "IMAGE='".$nameusb."'\n";
		print FD "IMAGE='".$namecd."'\n";
		print FD "IMAGE='/dev/ram1;$namecd'\n";
		print FD "IMAGE='/dev/loop1;$namecd'\n";
			print FD "UNIONFS_CONFIG='/dev/ram1,/dev/loop1,aufs'\n";
			print FD "UNIONFS_CONFIG='/dev/ram1,/dev/loop1,clicfs'\n";
			print FD "IMAGE='${device}${targetPartition};";
			print FD "$namecd;$server;$blocks;compressed'";
			print FD "IMAGE='${device}${targetPartition};";
			print FD "$namecd;$server;$blocks'";
				print FD "UNIONFS_CONFIG='".$value."'\n";