Added a check for CVE-2006-6979

Changelog.md

@@ -25,6 +25,7 @@ _latest update: Sun Jan  5 09:36:53 CET 2014_
 * Added a check for CVE-2006-5467
 * Added a check for CVE-2006-6303
 * Added a check for CVE-2006-6852
+* Added a check for CVE-2006-6979
 
 
 ## Version 0.85 - codename: elevator (2013-12-17)

Roadmap.md

@@ -70,7 +70,6 @@ _latest update: Fri Jan  3 15:15:33 CET 2014_
 * adding test for CVE-2008-3790
 * adding test for CVE-2008-2663
 * adding test for CVE-2007-6077
-* adding test for CVE-2006-6979
 * adding test for CVE-2007-6183
 * adding test for CVE-2007-2383
 * adding test for CVE-2007-2666
@@ -79,7 +78,6 @@ _latest update: Fri Jan  3 15:15:33 CET 2014_
 * adding test for CVE-2007-5380
 * adding test for CVE-2005-1992
 * adding test for CVE-2007-6077
-* adding test for CVE-2006-6979
 * adding test for CVE-2007-5162
 * adding test for CVE-2004-0983
 * adding test for CVE-2007-5379

lib/codesake/dawn/kb/cve_2006_6979.rb

@@ -0,0 +1,31 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-07
+			class CVE_2006_6979
+				include DependencyCheck
+
+				def initialize
+          message = "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
+
+          super({
+            :name=>"CVE-2006-6979",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2007, 2, 8),
+            :cwe=>"20",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"It seems there is no real workaround but not using amarok in your project. If it's needed, please sanitize your code before passing input to Magnatune component",
+            :aux_links=>["http://www.securityfocus.com/bid/22568"]
+          })
+
+          self.safe_dependencies = [{:name=>"amarok", :version=>['999.999.999']}]
+
+
+				end
+			end
+		end
+	end
+end

lib/codesake/dawn/knowledge_base.rb

@@ -41,6 +41,7 @@
 require "codesake/dawn/kb/cve_2006_5467"
 require "codesake/dawn/kb/cve_2006_6303"
 require "codesake/dawn/kb/cve_2006_6852"
+require "codesake/dawn/kb/cve_2006_6979"
 
 # CVE - 2010
 require "codesake/dawn/kb/cve_2010_1330"
@@ -204,6 +205,7 @@ def self.load_security_checks
           Codesake::Dawn::Kb::CVE_2006_5467.new, 
           Codesake::Dawn::Kb::CVE_2006_6303.new, 
           Codesake::Dawn::Kb::CVE_2006_6852.new, 
+          Codesake::Dawn::Kb::CVE_2006_6979.new, 
           Codesake::Dawn::Kb::CVE_2010_1330.new, 
           Codesake::Dawn::Kb::CVE_2011_0446.new, 
           Codesake::Dawn::Kb::CVE_2011_0447.new, 

spec/lib/dawn/codesake_knowledgebase_spec.rb

@@ -516,4 +516,9 @@
     sc.should_not   be_nil
     sc.class.should == Codesake::Dawn::Kb::CVE_2006_6852
   end
+  it "must have test for CVE-2006-6979" do
+    sc = kb.find("CVE-2006-6979")
+    sc.should_not   be_nil
+    sc.class.should == Codesake::Dawn::Kb::CVE_2006_6979
+  end
 end

spec/lib/kb/cve_2006_6979_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+describe "The CVE-2006-6979 vulnerability" do
+	before(:all) do
+		@check = Codesake::Dawn::Kb::CVE_2006_6979.new
+		# @check.debug = true
+	end
+	it "needs some test..."
+end