Vulnerability in newsbeuter - Arbitrary Shell Command Execution
Summary
DLA-1104-1: newsbeuter - security update. Affects newsbeuter versions < 2.5-2+deb7u3. Fixed in 2.5-2+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
newsbeuter is a text-mode RSS feed reader that allows users to read and manage their RSS feeds from the command line. It includes a podcast fetcher called podbeuter, which is responsible for fetching and playing podcast episodes. The vulnerability in newsbeuter allows a remote attacker to execute arbitrary shell commands on the client machine if the media enclosure (podcast file) is played in podbeuter.
Vulnerability Detail
The vulnerability arises from the lack of proper escaping of the media enclosure name in podbeuter. This allows an attacker to inject malicious shell commands that will be executed on the client machine when the file is played. The impact of this vulnerability depends on the privileges of the user running newsbeuter, but it could potentially lead to unauthorized access, data loss, or further compromise of the system.
How To Fix
Minimum fixed version
2.5-2+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade newsbeuterTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in newsbeuter allows for the execution of arbitrary shell commands on the client machine if a malicious media enclosure is played in podbeuter. It is crucial to upgrade to the fixed version of newsbeuter to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for newsbeuter →
FAQ
newsbeuter is a text-mode RSS feed reader that allows users to read and manage their RSS feeds from the command line.
podbeuter is the podcast fetcher included in newsbeuter, responsible for fetching and playing podcast episodes.
The vulnerability occurs due to the lack of proper escaping of the media enclosure name in podbeuter, allowing an attacker to inject malicious shell commands.
An attacker can execute arbitrary shell commands on the client machine if the media enclosure is played in podbeuter. The impact depends on the user's privileges and could range from unauthorized access to further compromise of the system.
To fix this vulnerability, you should upgrade the newsbeuter package to version 2.5-2+deb7u3 or later.
Related vulnerabilities
Recent vulnerabilities recorded for newsbeuter.
