First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 207331
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Robert Buchholz <rbu@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 207331 depends on: Show dependency tree
Bug 207331 blocks:

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2008-01-25 00:42 0000 
Miroslav Lichvar discovered that xdg-open allows for arbitrary command
execution in case the URL can not be handled by KDE, GNOME, XFCE or
mimeopen.

The vulnerable line:
  browser_with_arg=`echo "$browser" | sed s#%s#"$1"#`
should be rewritten as:
  browser_with_arg=${browser//'%s'/"$1"}

according to upstream.

This issue is under embargo until Monday, Jan 28. Drac and pva, please create
an updated ebuild and attach it to this bug if you want pre-stable testing to
commit straight to stable on the date of the disclosure.
Do not commit anything to CVS yet.

If you want someone else to take care of this issue, please cc him/her on this
bug.

------- Comment #1 From Robert Buchholz 2008-01-25 00:43:36 0000 ------- 
This affects xdg-email, too.

------- Comment #2 From Robert Buchholz 2008-01-25 00:54:45 0000 ------- 
That ${} is bash only, in case that is relevant (might need editing the #!)

------- Comment #3 From Robert Buchholz 2008-01-25 14:25:58 0000 ------- 
Patches are upstream, so this is semi-public. Please commit patches in the
tree.

http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open.in?r1=1.17&r2=1.18&view=patch
http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open?r1=1.32&r2=1.33&view=patch
http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?r1=1.24&r2=1.25&view=patch
http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email?r1=1.36&r2=1.37&view=patch

------- Comment #4 From Peter Volkov 2008-01-26 09:31:31 0000 ------- 
xdg-utils-1.0.2-r1.ebuild with fix applied commited.

------- Comment #5 From Robert Buchholz 2008-01-26 12:16:02 0000 ------- 
The "commit straight to stable" part in my original message was meant as in "if
you attach the ebuild here, Arch Liaisons can test it and we can commit to
stable afterwards".

Moving to [glsa] then.

------- Comment #6 From Robert Buchholz 2008-01-29 04:03:29 0000 ------- 
public via $url

------- Comment #7 From Pierre-Yves Rofes 2008-01-30 23:14:29 0000 ------- 
GLSA 200801-21
First Last Prev Next    No search results available      Search page      Enter new bug