[mat-dev] CVE-2017-9149

Borrar esta mensaxe

Responder a esta mensaxe
Autor: Dennis Fink
Data:  
Para: mat-dev
Asunto: [mat-dev] CVE-2017-9149
Hey,

I finally requested the CVE for the broken nautilus extension in version
0.6 and 0.6.1.

The CVE ID is CVE-2017-9149.

Following is the other data attached to the CVE:

[Suggested description]
Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions
upon invocation from the Nautilus contextual menu, which allows context-dependent attackers to
obtain sensitive information by reading a file for which cleaning had been attempted.

------------------------------------------

[VulnerabilityType Other]
Silently stops working

------------------------------------------

[Vendor of Product]
MAT Developers

------------------------------------------

[Affected Product Code Base]
MAT - 0.6
MAT - 0.6.1

------------------------------------------

[Affected Component]
Nautilus Extensions

------------------------------------------

[Attack Type]
Local

------------------------------------------

[CVE Impact Other]
Fails to clean metadata

------------------------------------------

[Reference]
https://0xacab.org/mat/mat/issues/11527
https://0xacab.org/mat/mat/commit/94ca62a429bb6a3a5f293de26053e54bbfeea9f9
https://0xacab.org/mat/mat/commit/8f6303a1f26fe8dad83ba96ab8328dbdfa3af59a
https://bugs.debian.org/858058

------------------------------------------

[Has vendor confirmed or acknowledged the vulnerability?]
true

Cheers,
metalgamer