CVE-2011-4195 (published 2014-04-16T18:37Z)

kiwi before 4.98.05, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in an image name.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/openSUSE/kiwi
commit_details: repo_url: https://github.com/openSUSE/kiwi
author: Marcus Schäfer
author_date: 2011-10-27 12:07:41+02:00
msg: - fixed quoting of parameters in config.isoclient
repository: repo_url: https://github.com/openSUSE/kiwi
repo_name: OSInside/kiwi-legacy
description: KIWI - Appliance Builder (legacy please read deprecation notice)
repo_language: Perl
owner: openSUSE
file_changes: filename: KIWIBoot.pm
change_type: ModificationType.MODIFY
diff: @@ -921,7 +921,7 @@ sub setupInstallCD {
 			$kiwi -> failed ();
 			return undef;
 		}
-		print FD "IMAGE=$namecd\n";
+		print FD "IMAGE='".$namecd."'\n";
 		close FD;
 		$kiwi -> info ("Importing system image: $system");
 		$status = qxx ("mv $system $tmpdir 2>&1");
@@ -1489,7 +1489,7 @@ sub setupInstallStick {
 			$this -> cleanLoop ();
 			return undef;
 		}
-		print FD "IMAGE=$nameusb\n";
+		print FD "IMAGE='".$nameusb."'\n";
 		close FD;
 		$main::global -> umount();
 		$kiwi -> done();
@@ -2572,7 +2572,7 @@ sub setupInstallFlags {
 			qxx ("rm -rf $irddir");
 			return undef;
 		}
-		print FD "IMAGE=$namecd\n";
+		print FD "IMAGE='".$namecd."'\n";
 		close FD;
 	}
 	#==========================================

programming_language: Perl
filename: KIWIImage.pm
change_type: ModificationType.MODIFY
diff: @@ -1931,15 +1931,15 @@ sub createImageLiveCD {
 		return undef;
 	}
 	if ((! defined $gzip) || ($gzip =~ /^(unified|clic)/)) {
-		print FD "IMAGE=/dev/ram1;$namecd\n";
+		print FD "IMAGE='/dev/ram1;$namecd'\n";
 	} else {
-		print FD "IMAGE=/dev/loop1;$namecd\n";
+		print FD "IMAGE='/dev/loop1;$namecd'\n";
 	}
 	if (defined $gzip) {
 		if ($gzip =~ /^unified/) {
-			print FD "UNIONFS_CONFIG=/dev/ram1,/dev/loop1,aufs\n";
+			print FD "UNIONFS_CONFIG='/dev/ram1,/dev/loop1,aufs'\n";
 		} elsif ($gzip =~ /^clic/) {
-			print FD "UNIONFS_CONFIG=/dev/ram1,/dev/loop1,clicfs\n";
+			print FD "UNIONFS_CONFIG='/dev/ram1,/dev/loop1,clicfs'\n";
 		} else {
 			print FD "COMBINED_IMAGE=yes\n";
 		}
@@ -2885,8 +2885,8 @@ sub writeImageConfig {
 		# IMAGE information
 		#------------------------------------------
 		if (($type{compressed}) && ($type{compressed} eq 'true')) {
-			print FD "IMAGE=${device}${targetPartition};";
-			print FD "$namecd;$server;$blocks;compressed";
+			print FD "IMAGE='${device}${targetPartition};";
+			print FD "$namecd;$server;$blocks;compressed'";
 			if ("$type{type}" eq "split" && defined $this->{imageTreeRW}) {
 				print FD ",${device}${targetPartitionNext}";
 				print FD ";$namerw;$server;$blocks;compressed\n";
@@ -2894,8 +2894,8 @@ sub writeImageConfig {
 				print FD "\n";
 			}
 		} else {
-			print FD "IMAGE=${device}${targetPartition};";
-			print FD "$namecd;$server;$blocks";
+			print FD "IMAGE='${device}${targetPartition};";
+			print FD "$namecd;$server;$blocks'";
 			if ("$type{type}" eq "split" && defined $this->{imageTreeRW}) {
 				print FD ",${device}${targetPartitionNext}";
 				print FD ";$namerw;$server;$blocks\n";
@@ -2935,7 +2935,7 @@ sub writeImageConfig {
 				$valid = 1;
 			}
 			if ($valid) {
-				print FD "UNIONFS_CONFIG=$value\n";
+				print FD "UNIONFS_CONFIG='".$value."'\n";
 			}
 		}
 		#==========================================

programming_language: Perl