|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: sysconfig: Improper quoting of variable (wireless AP related) | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE 12.1 | Reporter: | Jon Nelson <jnelson-suse> |
| Component: | Security | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | mt, security-team |
| Version: | Final | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | maint:released:sle10-sp3:44624 maint:released:sle10-sp4:44625 | ||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Deadline: | 2011-12-26 | ||
bugbot adjusting priority CVE-2011-4182 The SWAMPID for this issue is 44544. This issue was rated as moderate. Please submit fixed packages until 2011-12-26. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team. This is an autogenerated message for OBS integration: This bug (735394) was mentioned in https://build.opensuse.org/request/show/97040 12.1 / sysconfig https://build.opensuse.org/request/show/97041 11.4 / sysconfig https://build.opensuse.org/request/show/97042 11.3 / sysconfig https://build.opensuse.org/request/show/97043 Factory / sysconfig Update released for: sysconfig, sysconfig-debuginfo Products: SLE-SERVER 10-SP3-TERADATA (x86_64) released Update released for: sysconfig, sysconfig-debuginfo Products: SLE-DEBUGINFO 10-SP4 (i386, ia64, ppc, s390x, x86_64) SLE-DESKTOP 10-SP4 (i386, x86_64) SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64) This is an autogenerated message for OBS integration: This bug (735394) was mentioned in https://build.opensuse.org/request/show/105749 Evergreen:11.2 / sysconfig This is an autogenerated message for OBS integration: This bug (735394) was mentioned in https://build.opensuse.org/request/show/106448 Evergreen:11.2 / sysconfig |
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:8.0) Gecko/20100101 Firefox/8.0 In this context, the variable "CONFIG" comes from the *name* of the AP one might be associated with in a wireless environment (which can contain just about any old cruft.) In my case, I connected to a network with a space in the name, and *happened* to be watching /var/log/messages and /var/log/NetworkManager. This is what I saw: Dec 7 09:41:23 some_laptop dbus-daemon[20761]: scripts/ifup-services: line 98: test: ./ifcfg-wlan0-Uphill: binary operator expected Line 98-100 reads: test -f ./ifcfg-$CONFIG && . ./ifcfg-$CONFIG if [ -d "ifservices-$CONFIG" ] ; then cd ifservices-$CONFIG The first and third lines make use of $CONFIG _unquoted_. I can see this being a potential security issue. It's probably worth auditing the rest of the associated files for similar issues. Reproducible: Always Steps to Reproduce: 1. 2. 3.