Bug 80601 (CVE-2005-0758)

From: Mark J Cox <mjc@redhat.com>
To: viro@parcelfarce.linux.theplanet.co.uk
Cc: vendor-sec@lst.de
Subject: Re: [vendor-sec] quoting bugs in (b)zgrep

Use CAN-2005-0758 for this issue, (we're going to push updates out with this fix
shortly)

Thanks, Mark
-- 
Mark J Cox / Red Hat Security Response Team

On Thu, 22 Apr 2004 viro@parcelfarce.linux.theplanet.co.uk wrote:

> zgrep contains the following gem:
> 
> for i do
> [snip]
>      if test $with_filename -eq 1; then
>        sed_script="s|^[^:]*:|${i}:|"
>      else
>        sed_script="s|^|${i}:|"
>      fi
>      $grep $opt "$pat" | sed "$sed_script"
> [snip]
> done
> 
> Aside of the correctness issues (try to use zgrep on files with e.g. '&' in
> names), it leads to obvious fun when zgrep arguments had been obtained
> by globbing in an untrusted place.  Even with standard sed we have at
> least ;w<filename>; to deal with; for GNU sed there's also ;e; on top
> of that (execute the contents of pattern space).  bzgrep is no better -
> it's based on zgrep.
> 
> AFAICS, there are two solutions - one is to do what *BSD had done and
> make grep(1) use zlib and libbz; then zgrep et.al. become links to
> grep.  Another is to quote \, |, ; and newlines, which means extra
> invocation of sed(1)...
> _______________________________________________
> Vendor Security mailing list
> Vendor Security@lst.de
> https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>