Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Apr 2011 17:06:11 +0200
From: Yves-Alexis Perez <>
Subject: Re: CVE request for Thunar (format string errors)

On ven., 2011-04-15 at 16:50 +0200, Tomas Hoger wrote:
> On Fri, 15 Apr 2011 15:54:08 +0200 Yves-Alexis Perez wrote:
> > The first one is
> >
> > (bug at  fixed in
> > Thunar 1.2.1) and triggers when creating file from templates and
> > calling it with a format string.
> Does this have real attack vector where trust boundary is crossed?
> This sounds like a bug.

Yeah, I don't think there's a way to ask Thunar to create a new file
from a template programmatically, so the user really needs to go to the
menu and create it.
> > The second is
> >
> > and is triggered when copy/pasting a file named from a format
> string.
> > There's no released version including the fix right now.
> This would probably qualify.

Even if the user has to manually Ctrl-C/Ctrl-V the file in Thunar?
> > As a side note, I do use -Wformat -Wformat-security
> > -Werror=format-security (thanks to hardening-includes) for my Debian
> > builds, but as those function are wrappers of wrappers of wrappers
> to
> > printf() and stuff like that, -Wformat-security won't help. Is there
> a
> > way to work around that?
> Fortify source should block code execution even in this case, I'd
> expect.

Yeah hopefully, but I was more thinking on a way to detect the format
string error at compilation time. Manually it's kind of a pain as one
has to check every usage of a function using va_args.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.