[ GLSA 201801-06 ] Back In Time

[GLSA]

Gentoo Linux Security Advisory

Title: Back In Time: Command injection (GLSA 201801-06)
Severity: normal
Exploitable: local, remote
Date: 2018-01-07
Bug(s): #636974
ID: 201801-06

Synopsis

A command injection vulnerability in 'Back in Time' may allow for
the execution of arbitrary shell commands.


Background

A simple backup tool for Linux, inspired by “flyback project”.

Affected Packages

Package: app-backup/backintime
Vulnerable: < 1.1.24
Unaffected: >= 1.1.24
Architectures: All supported architectures


Description

‘Back in Time’ did improper escaping/quoting of file paths used as
arguments to the ‘notify-send’ command leading to some parts of file
paths being executed as shell commands within an os.system call.


Impact

A context-dependent attacker could execute arbitrary shell commands via
a specially crafted file.


Workaround

There is no known workaround at this time.

Resolution

All ‘Back In Time’ users should upgrade to the latest version: