[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Dec 2012 18:05:40 +0100
From: Frank Lanitz <frank@...nk.uvena.de>
To: Jan Lieskovsky <jlieskov@...hat.com>
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
oss-security@...ts.openwall.com, Nick Treleaven
<nick.treleaven@...nternet.com>, Colomban Wendling
<lists.ban@...besfolles.org>, Enrico Troeger <enrico.troeger@...na.de>,
Matthew Brush <mbrush@...ebrainz.ca>, josef@...icpanda.com,
jonathan.underwood@...il.com
Subject: Re: Geany IDE not escaping filenames during compilation / build - a
security issue or not?
Hi folks,
On Wed, 12 Dec 2012 11:51:33 -0500 (EST)
Jan Lieskovsky <jlieskov@...hat.com> wrote:
> Background: Geany is a small and fast integrated development
> enviroment with basic features and few dependencies to other packages
> or Desktop Environments.
>
> Based on (you might need to click 'Yes, I agree' OK to
> get the exploit code in [2]):
> [1] https://bugs.gentoo.org/show_bug.cgi?id=446986
> [2] http://www.1337day.com/exploit/19924
>
> it was found that Geany is not escaping filenames (when compiling /
> building source) prior passing the final command line to shell.
>
> The questions:
> 1) should Geany escape the filenames?,
> 2) is this a security issue or not?
>
> Two views:
> * view #1 - it shouldn't escape the filenames. It's just IDE,
> so what it obtains as input is passed to shell for execution.
>
> * view #2 - it should escape the filenames (because this is what
> shell / bash is doing) prior making the build.
>
> Obviously, even for gcc you can pass specially-crafted filename,
> when attempt to build it would lead to "ls -la" command (for example)
> to be executed.
>
> I by myself am not sure / not able to decide here.
>
> Steve, could you hint? Does Mitre have some guidance / document,
> how to deal with cases like this one?
I didn't try it out by now.
Even though this is really not the best behavior at least I don't see
a real security issue here. Of course you could download a file called
foo.c"rm -rf /", open it and try to run it, but this would only be
executed with user's context which in the end doesn't make any
differences whether you having a shell script like
#!/bin/sh
rm -rf /;
or funny_shell_script.sh"rm -rf /" downloading. /dev/user is needed
here.
However, should be fixed of course as its dangerous behavior
nevertheless. ;)
Just my 2ct.
Cheers,
Frank
--
Frank Lanitz <frank@...nk.uvena.de>
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
