Vulnerabilities > CVE-2013-7069 - Code Injection vulnerability in Beyondgrep ACK

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2013-23197.
#

include("compat.inc");

if (description)
{
  script_id(71550);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2013-7069");
  script_bugtraq_id(64196);
  script_xref(name:"FEDORA", value:"2013-23197");

  script_name(english:"Fedora 20 : ack-2.12-1.fc20 (2013-23197)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This version of ack prevents the --pager, --regex and --output options
from being used from project-level ackrc files. It is possible to
execute malicious code with these options, and we want to prevent the
security risk of acking through a potentially malicious codebase, such
as one downloaded from an Internet site or checked out from a code
repository.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=1040228"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2013-December/124539.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?dc4e5fc4"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected ack package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:ack");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:20");

  script_set_attribute(attribute:"patch_publication_date", value:"2013/12/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/12/20");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^20([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 20.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC20", reference:"ack-2.12-1.fc20")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ack");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2014-87.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(75410);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2013-7069");

  script_name(english:"openSUSE Security Update : ack (openSUSE-SU-2014:0142-1)");
  script_summary(english:"Check for the openSUSE-2014-87 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"  - update to ack 2.12: fixes potential remote code
    execution via per-project .ackrc files [bnc#855340]
    [CVE-2013-7069]

  - prevents the --pager, --regex and --output options from
    being used from project-level ackrc files, preventing
    possible code execution when using ack through malicious
    files

  - --pager, --regex and --output options may still be used
    from the global /etc/ackrc, your own private ~/.ackrc,
    the ACK_OPTIONS environment variable, and of course from
    the command line.

  - Now ignores Eclipse .metadata directory.

  - includes changes form 2.11_02 :

  - upstream source mispackaging fix

  - includes changes from 2.11_01

  - Fixed a race condition in t/file-permission.t that was
    causing failures if tests were run in parallel.

  - includes changes from 2.10 :

  - Add --perltest for *.t files

  - Added Matlab support

  - More compatibility fixes for Perl 5.8.8.

  - includes changes from 2.08

  - ack now ignores CMake's build/cache directories by
    default

  - Add shebang matching for --lua files

  - Add documentation for --ackrc

  - Add Elixir filetype

  - Add --cathy option

  - Add some helpful debugging tips when an invalid option
    is found

  - Ignore PDF files by default, because Perl will detect
    them as text

  - Ignore .gif, .jpg, .jpeg and .png files. They won't
    normally be selected, but this is an optimization so
    that ack doesn't have to open them to know

  - Ack's colorizing of output would get confused with
    multiple sets of parentheses

  - Ack would get confused when trying to colorize the
    output in DOS-format files

  - includes changes from 2.05_01

  - We now ignore the node_modules directories created by
    npm

  - --pager without an argument implies --pager=$PAGER

  - --perl now recognizes Plack-style .psgi files

  - Added filetypes for Coffescript, JSON, LESS, and Sass.

  - Command-line options now override options set in ackrc
    files

  - ACK_PAGER and ACK_PAGER_COLOR now work as advertised.

  - Fix a bug resulting in uninitialized variable warnings
    when more than one capture group was specified in the
    search pattern

  - Make sure ack is happy to build and test under cron and
    other console-less environments.

  - packaging changes :

  - run more rests with IO::Pty

  - refresh ack-ignore-osc.patch for upstream changes

  - update project URL

  - port changes from devel:languages:perl ack by
    [email protected] :

  - correct metadata: licence, CPAN download, homepage

  - unset forced prefix - let Perl configuration and
    toolchain determine the prefix/install_base which will
    DTRT

  - bash completion is gone, remove dead code

  - modified patches :

  - ack-ignore-osc.patch adjust for upstream source changes"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=855340"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2014-01/msg00094.html"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected ack packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:ack");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-App-Ack");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1");

  script_set_attribute(attribute:"patch_publication_date", value:"2014/01/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE13\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);



flag = 0;

if ( rpm_check(release:"SUSE13.1", reference:"ack-2.12-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"perl-App-Ack-2.12-3.4.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ack / perl-App-Ack");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2013-23206.
#

include("compat.inc");

if (description)
{
  script_id(71551);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2013-7069");
  script_bugtraq_id(64196);
  script_xref(name:"FEDORA", value:"2013-23206");

  script_name(english:"Fedora 19 : ack-2.12-1.fc19 (2013-23206)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This version of ack prevents the --pager, --regex and --output options
from being used from project-level ackrc files. It is possible to
execute malicious code with these options, and we want to prevent the
security risk of acking through a potentially malicious codebase, such
as one downloaded from an Internet site or checked out from a code
repository.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=1040228"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2013-December/124543.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?15b6210a"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected ack package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:ack");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:19");

  script_set_attribute(attribute:"patch_publication_date", value:"2013/12/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/12/20");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^19([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 19.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC19", reference:"ack-2.12-1.fc19")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ack");
}