416833 – man opens arbitrary language file with infected LANG environment variable

Bug 416833 - man opens arbitrary language file with infected LANG environment variable

Summary: man opens arbitrary language file with infected LANG environment variable

Status:	RESOLVED INVALID

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	Current packages (show other bugs)
Hardware:	All Linux

Importance:	Normal normal
Assignee:	Gentoo Linux bug wranglers

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2012-05-21 01:08 UTC by Stephen Shkardoon
Modified:	2012-05-23 13:38 UTC (History)
CC List:	0 users

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Stephen Shkardoon 2012-05-21 01:08:00 UTC

Crisp linux-3.2.11-hardened # LANG="../../../../../home/ss23" strace man --help 2>&1 | grep open
...
open("/usr/share/locale/C/man", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/C/LC_MESSAGES/man", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/C/man", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/C/LC_MESSAGES/man", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/C/man", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/C/LC_MESSAGES/man", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/C/man", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/C/LC_MESSAGES/man", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/../../../../../home/ss23/man", O_RDONLY) = 3

The file will be opened and certain strings from it passed to printf (which I assume can be used as an format string exploit thingy, not sure, I'm not good with this stuff).
Not really a security bug I guess since it's not suid, and I'm not sure whether intput to printf is filtered at all.

man-db does not seem to have this same issue.

Reproducible: Always

Comment 1 Jeroen Roovers (RETIRED) gentoo-dev

2012-05-23 13:38:04 UTC

Please try `LANG= man localedef' and read a bit about the LANG variable. It's not supposed to point to a directory. If you want to open a specific manual, you can simply do `man /path/to/man/file'.