Re: Comprehensive patch escaping system/open calls in vfs/extfs
- From: Jakub Jelinek <jakub redhat com>
- To: Leonard den Ottolander <leonard den ottolander nl>
- Cc: MC <mc gnome org>
- Subject: Re: Comprehensive patch escaping system/open calls in vfs/extfs
- Date: Sat, 21 Aug 2004 17:32:02 +0200
On Sat, Aug 21, 2004 at 07:37:06PM +0200, Leonard den Ottolander wrote:
--- extfs/a.in 2004-08-21 13:45:50.000000000 +0200
+++ extfs/a.in 2004-08-21 19:06:15.458358276 +0200
@@ -36,17 +36,20 @@ SWITCH: for ( $ARGV[0] ) {
/mkdir/ && do {
shift; shift;
exit 1 if scalar(@ARGV) != 1;
- system("$mmd $qdisk:/$ARGV[0] >/dev/null");
+ $qname = quote($ARGV[0]);
+ system("$mmd $qdisk:/$qname >/dev/null");
exit 0; };
/rmdir/ && do {
shift; shift;
exit 1 if scalar(@ARGV) != 1;
- system("$mrd $qdisk:/$ARGV[0] >/dev/null");
+ $qname = quote($ARGV[0]);
+ system("$mrd $qdisk:/$qname >/dev/null");
exit 0; };
/rm/ && do {
shift; shift;
exit 1 if scalar(@ARGV) != 1;
- system("$mdel $qdisk:/$ARGV[0] >/dev/null");
+ $qname = quote($ARGV[0]);
+ system("$mdel $qdisk:/$qname >/dev/null");
exit 0; };
/copyout/ && do {
shift; shift;
Nope. The value of $ARGV[0] is already known because of the SWITCH.
There are two shifts in between.
Try:
strace -f /usr/share/mc/extfs/a mkdir a 'touch `date` me' 2>&1 | grep exec
execve("/usr/share/mc/extfs/a", ["/usr/share/mc/extfs/a", "mkdir", "a", "touch `date` me"], [/* 32 vars */])
= 0
[pid 24053] execve("/bin/sh", ["sh", "-c", "mmd a:/touch `date` me >/dev/nul"...], [/* 34 vars */]) = 0
[pid 24055] execve("/bin/date", ["date"], [/* 33 vars */]) = 0
[pid 24056] execve("/usr/bin/mmd", ["mmd", "a:/touch", "Sat", "Aug", "21", "19:45:57", "CEST", "2004", "me"],
[/* 33 vars */]) = 0
while with the patched a:
strace -f /tmp/a mkdir a 'touch `date` me' 2>&1 | grep exec
execve("/tmp/a", ["/tmp/a", "mkdir", "a", "touch `date` me"], [/* 32 vars */]) = 0
[pid 24061] execve("/bin/sh", ["sh", "-c", "mmd a:/touch\\ \\`date\\`\\ me >/dev"...], [/* 34 vars */]) = 0
[pid 24062] execve("/usr/bin/mmd", ["mmd", "a:/touch `date` me"], [/* 33 vars */]) = 0
As how it could be exploited, suppose a hostile collegue gives you a
flopy with a file
veeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeery`rm -rf ~/`loooooooooooooooooooooooooooooongfilename
on it.
You press F8 on it and there you go.
Jakub
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]