Bug 245966 – sys-process/htop <0.8.1-r1 Does not filter non-printable characters in process names (CVE-2008-5076)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Robert Buchholz (RETIRED) 2008-11-07 13:58:40 UTC]

Nico Golde wrote:
htop doesn't filter non printable characters in process 
names which enables processes doing evil things with the 
display using escape sequences.

[Comment 1 Jaak Ristioja 2008-11-15 08:38:13 UTC]

Found this: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5076

[Comment 2 Stefan Behte (RETIRED) 2008-11-15 21:22:40 UTC]

The patch (see $URL):

diff -r d816b3b76b28 RichString.c
--- a/RichString.c	Sat Nov 15 04:42:09 2008 +0200
+++ b/RichString.c	Sat Nov 15 05:09:32 2008 +0200
@@ -29,7 +29,7 @@
 inline void RichString_appendn(RichString* this, int attrs, char* data, int len) {
    int last = MIN(RICHSTRING_MAXLEN - 1, len + this->len);
    for (int i = this->len, j = 0; i < last; i++, j++)
-      this->chstr[i] = data[j] | attrs;
+      this->chstr[i] = ((data[j] > 31) ? data[j] : '?' ) | attrs;
    this->chstr[last] = 0;
    this->len = last;
 }

[Comment 3 Stefan Behte (RETIRED) 2008-11-15 22:16:17 UTC]

CVE-2008-5076 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5076):
  htop 0.7 writes process names to a terminal without sanitizing
  non-printable characters, which might allow local users to hide
  processes, modify arbitrary files, or have unspecified other impact
  via a process name with "crazy control strings."

[Comment 4 Robert Buchholz (RETIRED) 2008-11-29 11:45:18 UTC]

ping, please bump.

[Comment 5 Wolfram Schlich (RETIRED) 2008-11-29 19:01:37 UTC]

Fixed in 0.8.1-r1.
I'm giving up maintainership of htop, so I'm un-Cc'ing myself now.

[Comment 6 Robert Buchholz (RETIRED) 2008-11-29 19:22:02 UTC]

Arches, please test and mark stable:
=sys-process/htop-0.8.1-r1
Target keywords : "amd64 arm hppa ia64 ppc ppc64 sparc x86"

[Comment 7 Samuli Suominen (RETIRED) 2008-11-30 08:09:05 UTC]

*** Bug 246309 has been marked as a duplicate of this bug. ***

[Comment 8 Markus Meier 2008-11-30 14:49:24 UTC]

amd64/x86 stable

[Comment 9 Raúl Porcel (RETIRED) 2008-11-30 18:28:56 UTC]

arm/ia64/sparc stable

[Comment 10 Thomas Anderson (tanderson) (RETIRED) 2008-11-30 18:57:34 UTC]

Samuli and I are the new htop maintainers.

[Comment 11 Tobias Scherbaum (RETIRED) 2008-11-30 21:16:17 UTC]

ppc stable

[Comment 12 Jeroen Roovers (RETIRED) 2008-12-01 06:34:16 UTC]

Stable for HPPA.

[Comment 13 Brent Baude (RETIRED) 2008-12-01 15:39:35 UTC]

ppc64 done

[Comment 14 Samuli Suominen (RETIRED) 2008-12-02 18:47:32 UTC]

Vulnerable versions removed from tree.

[Comment 15 Pierre-Yves Rofes (RETIRED) 2008-12-02 22:35:34 UTC]

time for GLSA decision, I tend to vote NO.

[Comment 16 Robert Buchholz (RETIRED) 2008-12-03 11:07:16 UTC]

(In reply to comment #15)
> time for GLSA decision, I tend to vote NO.

NO as well, closing. Feel free to reopen if you disagree.