| Summary: | man opens arbitrary language file with infected LANG environment variable | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Stephen Shkardoon <ss23> |
| Component: | Current packages | Assignee: | Gentoo Linux bug wranglers <bug-wranglers> |
| Status: | RESOLVED INVALID | ||
| Severity: | normal | ||
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
Please try `LANG= man localedef' and read a bit about the LANG variable. It's not supposed to point to a directory. If you want to open a specific manual, you can simply do `man /path/to/man/file'. |
Crisp linux-3.2.11-hardened # LANG="../../../../../home/ss23" strace man --help 2>&1 | grep open ... open("/usr/share/locale/C/man", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/share/locale/C/LC_MESSAGES/man", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/share/locale/C/man", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/share/locale/C/LC_MESSAGES/man", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/share/locale/C/man", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/share/locale/C/LC_MESSAGES/man", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/share/locale/C/man", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/share/locale/C/LC_MESSAGES/man", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/share/locale/../../../../../home/ss23/man", O_RDONLY) = 3 The file will be opened and certain strings from it passed to printf (which I assume can be used as an format string exploit thingy, not sure, I'm not good with this stuff). Not really a security bug I guess since it's not suid, and I'm not sure whether intput to printf is filtered at all. man-db does not seem to have this same issue. Reproducible: Always