Attachment 22302 Details for Bug 58152

mcvfs-gnomevfs.txt

mcvfs-gnomevfs.txt (text/plain), 4.51 KB, created by Thomas Biege on 2004-07-20 20:01:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2004-07-20 20:01:37 UTC

Size: 4.51 KB

patch

obsolete

>From alexl@redhat.com Tue Jul 20 13:49:31 2004
>Date: 16 Jun 2004 14:33:30 +0200
>From: Alexander Larsson <alexl@redhat.com>
>To: vendor-sec@lst.de
>Subject: [vendor-sec] mc and gnome-vfs extfs vulnerability (CAN-2004-0494)
>
>I got a report yesterday about a vulnerability in the extfs backend of
>gnome-vfs. This is a backend that lets you implement gnome-vfs backends
>using scripts that was inherited from the vfs in midnight commander.
>
>Mark Cox assigned me the number CAN-2004-0494 for this issue, and
>recommended an embargo date of July 14th.
>
>The core problem is that many of the extfs scripts shipped with
>gnome-vfs and mc are not careful about user input. For instance, you can
>do this:
>
>alex@greebo /tmp/vfs $ ls -l
>total 0
>-rw-rw-r--    1 alex     alex            0 Jun 16 14:13 \|\ touch\
>hacked.deb
>alex@greebo /tmp/vfs $ gnomevfs-cat "file:///tmp/vfs/| touch
>hacked.deb#deb:blah"
>sh: line 1: dpkg-deb: command not found
>tar: blah: Not found in archive
>tar: Error exit delayed from previous errors
>alex@greebo /tmp/vfs $ ls -l
>total 0
>-rw-------    1 alex     alex            0 Jun 16 14:14 hacked.deb
>-rw-rw-r--    1 alex     alex            0 Jun 16 14:13 \|\ touch\
>hacked.deb
>
>The same thing happens if you use midnight commander to open the file.
>
>This particular issue is caused by the "deb" extfs script doing:
>  if ( open(PIPEIN, "dpkg-deb -c $archivename |") )
>I haven't looked at it in detail, but its likely that other scripts have
>similar problems.
>
>To exploit someone using this requires you to get a user to open a
>hand-crafted URI with gnome-vfs or mc. One way to do that with gnome-vfs
>is to have the user click on a desktop file link (that you created) in
>nautilus.
>
>For the case of gnome-vfs, I think the best approach to fixing this is
>to just disable extfs. It doesn't work well since chained URI handling
>isn't quite working, and the only way to use it is to type in the uri
>manually. I'm not sure how used this is in midnight commander though,
>maybe it can't just be disabled there.
>
>The easiest way to disable it is by removing
>/usr/lib/gnome-vfs-2.0/modules/libextfs.so and the extfs line in
>/etc/gnome-vfs-2.0/modules/default-modules.conf.
>Also, the same goes for gnome-vfs 1.x, with the files being
>/usr/lib/vfs/modules/libextfs.so and
>/etc/vfs/modules/default-modules.conf
>
>=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
> Alexander Larsson                                            Red Hat, Inc 
>                   alexl@redhat.com    alla@lysator.liu.se 
>He's a suave misogynist barbarian haunted by an iconic dead American 
>confidante She's a psychotic cigar-chomping bounty hunter with the power to 
>bend men's minds. They fight crime! 
>
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From bressers@redhat.com Tue Jul 20 13:50:44 2004
>Date: Tue, 13 Jul 2004 08:51:22 -0400
>From: Josh Bressers <bressers@redhat.com>
>To: Alexander Larsson <alexl@redhat.com>
>Cc: vendor-sec@lst.de
>Subject: Re: [vendor-sec] mc and gnome-vfs extfs vulnerability
>    (CAN-2004-0494) 
>
>> I got a report yesterday about a vulnerability in the extfs backend of
>> gnome-vfs. This is a backend that lets you implement gnome-vfs backends
>> using scripts that was inherited from the vfs in midnight commander.
>> 
>> Mark Cox assigned me the number CAN-2004-0494 for this issue, and
>> recommended an embargo date of July 14th.
>
>Given the PHP issue being so close, I would like to recommend we extend
>this embargo date to August 4.
>
>-- 
>    JB
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From bressers@redhat.com Tue Jul 20 13:51:07 2004
>Date: Thu, 15 Jul 2004 16:29:28 -0400
>From: Josh Bressers <bressers@redhat.com>
>To: vendor-sec@lst.de
>Subject: Re: [vendor-sec] mc and gnome-vfs extfs vulnerability
>    (CAN-2004-0494) 
>
>> > I got a report yesterday about a vulnerability in the extfs backend of
>> > gnome-vfs. This is a backend that lets you implement gnome-vfs backends
>> > using scripts that was inherited from the vfs in midnight commander.
>> > 
>> > Mark Cox assigned me the number CAN-2004-0494 for this issue, and
>> > recommended an embargo date of July 14th.
>
>Has anyone looked into how this affects mc?  I've verified that mc does
>suffer from this issue, but yet to look into a solution.
>
>-- 
>    JB
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

Actions: View

Attachments on bug 58152: 22302 | 26091 | 26092