Bug 59220 (CVE-2004-1170)

This is a forwarded mail from feedback@suse.de (stts):

    Summary: (security) bug in a2ps file name handling
 Salutation: Mr.
   Language: english
       Name: Hansjoerg Lipp
       Mail: hjlipp@web.de
   Language: english
Packagename: a2ps
  Component: ConsoleApps
Productname: SUSE LINUX
Versionname: SUSE LINUX 9.0 professional
   Platform: i386
   Severity: Normal bug: Work is seriously hindered

Description hardware:



Description how to reproduce:

1. How to reproduce:

a2ps filename

with filename containing characters with a special meaning for the shell ($,`,...)

cd /tmp
echo '/* test */' > 'x`touch FOO.BAR`.c'
a2ps x*.c -o whatever
ls FOO.BAR
 
2. This is not working:

a2ps passes file names to the shell without escaping special characters. See also
 <news:slrncim2k0.dqc.divzero@message-id.durchnull.ath.cx> or
 <http://groups.google.com/groups?q=msgid%3Aslrncim2k0.dqc.divzero%40message-id.durchnull.ath.cx>

This is also a security problem. The patch from
 <http://www.freebsd.org/cgi/cvsweb.cgi/~checkout~/ports/print/a2ps-letter/files/patch-select.c?rev=1.1&content-type=text/plain>
mentioned in that article does also work with the SuSE rpm. I'd have sent you a
working spec file, but the package maintainers are not interested in direct
feedback.




** This bugreport was generated by STTS-FB
** http://feedback.suse.de/cgi-bin/history.pl?&ticket=20040825990000034