Bugzilla Bug 234079

** Please note that this issue is confidential and no information should be
disclosed until it is made public, see "Whiteboard" for a date **

Aaron Grattafiori writes:
Gnome's help program "yelp" is affected by a classic format string
vulnerability
when reporting an invalid URI using a gtk_message_dialog. The function
gtk_message_dialog_format_secondary_markup()
is called without a format string.


Details:
--------
After specifying an invalid URI, using ftp:// or file:// (or even no URI
handler at all!)
An error message saying "The requested URI %s is invalid" is created using on
line 1008 of yelp-window.c which
passes the gchar string into the window_error function located at 1129 of the
same file.
The GTK dialog box is then created insecurely by *not* using a format string at
line 1156 of yelp-window.c.

The function prototype for gtk_message_dialog_format_secondary_markup is:
void    gtk_message_dialog_format_secondary_markup (GtkMessageDialog
*message_dialog,
                                                         const gchar
*message_format,
                                                                               
...);
where message_format is a "printf()-style markup string".
see:
http://library.gnome.org/devel/gtk/2.12/GtkMessageDialog.html#gtk-message-dialog-format-secondary-markup
Incorrect/vulnerable usage here:
http://svn.gnome.org/viewvc/yelp/trunk/src/yelp-window.c?revision=3145&view=markup
You can see the code was changed "cleaned up" from properly using a format
string, to its removal here:
http://svn.gnome.org/viewvc/yelp/trunk/src/yelp-window.c?annotate=2848#l1130

PoC:
----
yelp ftp://%08x.%08x.%08x.%08x.%08x.%08x
yelp %x%x%x%x%x%x://
yelp %08x%08x

Impact:
------

Because of yelp's network capability, this vulnerably may be remotely
exploitable via minimal user-assistance in Firefox, Evolution and other
programs with the 'man' or 'ghelp' URIs registered. Evolution will prompt the
user for confirmation (which displays the program and arguments) but sadly
Firefox 3.0 does not allow for preview of the arguments being passed. (I think
all arguments being passed to applications via Firefox or whatever program
should be displayed.
This seems like a regression in security from Firefox 2) 
This vulnerability could be exploited to execute arbitrary code with the user's
privileges and possible user-assisted execution of arbitrary code by clicking
on a malicious link.

Effected Versions:
---------
All newer than 2.19.90

Fix:
----------
Patch the function call to use a format string per GTK+ documentation.
Similar to the properly used call gtk_message_dialog_format_secondary_text()
at line 581 of yelp-print.c

Created an attachment (id=162428) [details]
Proposed patch

Created an attachment (id=162430) [details]
2.20.0 bump ebuild for most arches

Created an attachment (id=162431) [details]
2.22.1 bump ebuild for amd64

Okay, here's a patch, and 2 ebuilds that apply it.  Most arches have 2.20.0
stable, but 2.22 is in the process of going stable (and amd64 has it stable). 
All arches that are going stable with 2.22 should test both (except amd64 which
only needs to test 2.22.1-r2).  Fortunately, the same patch applies to both.

Thanks for patch and ebuild.

Arch Security Liaisons, please test the attached ebuild and report it stable on
this bug.
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 sh sparc x86"

CC'ing current Liaisons:
   alpha : yoswink, armin76
   amd64 : keytoaster, tester
    hppa : jer
     ppc : dertobi123
   ppc64 : corsair
   sparc : fmccor
     x86 : maekke, armin76

yelp-2.22.1-r2 looks good on amd64/x86.

looks good on ppc64

Looks okay on alpha/ia64/sparc

HPPA is OK.

yelp-2.22.1-r2 okay for ppc

Public via $URL. Please commit with the stable keywords gathered in this bug.

Committed.

GLSA 200809-01