Subject: Notification: incoming/690

From: [email-masked]
Date: Mon, 15 Jan 2001 14:35:34 -0600

FVWM Bug Tracking notification

new message incoming/690

Message summary for PR#690
	From: [email-masked]
	Subject: PRIVATE: Loading of config file is insecure
	Date: Mon, 15 Jan 2001 14:35:33 -0600
	0 replies 	0 followups

====> ORIGINAL MESSAGE FOLLOWS <====

>From [email-masked] Mon Jan 15 14:35:33 2001
From: [email-masked]
To: [email-masked]
Subject: PRIVATE: Loading of config file is insecure
Date: Mon, 15 Jan 2001 14:35:33 -0600

Full_Name: Tilmann Boess
Version: 2.2.4
CVS_Date: 
OS: SuSE Linux 7.0 (Linux 2.2.16)
X_Server: XFree86 4.0
Submission from: (NULL) (62.158.124.180)

fvwm2's manpage states that `fvwm will search for a file named .fvwm2rc 
in the user's home directory, then in ${sysconfdir} (typically 
/usr/local/etc).  Failing  that, it  will look for system.fvwm2rc in 
${sysconfdir} for system-wide defaults.'  This is not true.  First, fvwm2
tries to load .fvwm2rc from the current directory, then it tries to load
~~/.fvwm2rc and as a last resort it looks for the system-wide .fvwm2rc.

So it is easy for an local attacker to set up a trap:  Create a malicious 
.fvwm2rc in a writable directory and wait for other users (root is most 
attractive, of course) to start fvwm2 from that directory.  Note that an 
existing .fvwm2rc in the user's home directory does not help because 
.fvwm2rc in the current directory is loaded first.

I created a patch for the file fvwm/read.c and will happily supply it.
Just tell me an email address that I can send the patch to.

--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Dominik Vogt <[email-masked]>
Date: Tue, 16 Jan 2001 23:21:58 +0100

> Just tell me an email address that I can send the patch to.

Well' thats the first good reason I saw for as 2.2.5 release :-)
You can send patches to [email-masked].  You could also
provide small patches as text in a bug report, but please do not
send multiple mails over the bug tracking engine because they will
all appear as reports.

Bye

Dominik ^_^  ^_^

--
Dominik Vogt, [email-masked]
Reply-To: [email-masked]
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: [email-masked] (Tilmann Boess)
Date: Wed, 17 Jan 2001 21:31:11 +0100 (CET)

-----BEGIN PGP SIGNED MESSAGE-----

Hi,

attached to this mail is my suggested patch for fvwm/read.c that fixes the
bug incoming/690.

760fd98659bc1fe78fd3676794b11da4  read.c.patch

I hope you find it useful.  It fixes the problem that fvwm2 first tries to
load .fvwm2rc from the current directory, then from the home directory and
last from the system default directory.  With the patch, .fvwm2rc is
searched first in the home directory and then in the system default
directory.

Perhaps it is a bit rude to not set Home at all, if HOME is not found in
the environment; it might be better to terminate fvwm2 if this happens.
The original code sets Home to . in this case (and so .fvwm2rc is searched
again in the current directory).  If you have any suggestions for the
patch, just send me a mail.

- -- 
   Tilmann Boess       (TeX: Tilmann B\"o\ss)
                 e-mail: <[email-masked]>

--- fvwm/read.c.dist	Mon Jan 11 06:00:28 1999
+++ fvwm/read.c	Wed Jan 17 20:26:05 2001
@@ -9,6 +9,12 @@
  * Changed 09/24/98 by Dan Espen:
  * - remove logic that processed and saved module configuration commands.
  * Its now in "modconf.c".
+ *
+ * Changed 2001-01-12 by Tilmann Boess:
+ * - more debug output when loading config file
+ * - config file is no longer searched in the present working directory
+ * - Home is no longer set to . if HOME isn't set in the environment
+ * 
  * *************************************************************************
  */
 #include "config.h"
@@ -70,7 +76,7 @@
   thisfileno = numfilesread;
   numfilesread++;
 
-/*  fvwm_msg(INFO,cmdname,"action == '%s'",action); */
+  fvwm_msg(INFO,cmdname,"action == '%s'",action);
 
   rest = GetNextToken(action,&ofilename); /* read file name arg */
   if(ofilename == NULL)
@@ -89,28 +95,35 @@
   } /* end there is a second arg */
 
   filename = ofilename;
-/*  fvwm_msg(INFO, cmdname,"trying '%s'",filename); */
+  fvwm_msg(INFO, cmdname,"trying '%s'",filename);
 
-  if (piperead)
+  if (piperead) {
+    if (debugging)
+    {
+      fvwm_msg(DBG,"ReadSubFunc","popen: '%s'",filename);
+    }
     fd = popen(filename,"r");
-  else
-    fd = fopen(filename,"r");
-
-  if (!piperead)
-  {
-    if (fd == 0 && ofilename[0] != '/')
+  } 
+  else {
+    if (ofilename[0] != '/')
       {
 	/* find the home directory to look in */
 	Home = getenv("HOME");
-	if (Home == NULL)
-	  Home = ".";
-	home_file = safemalloc(strlen(Home) + strlen(ofilename)+3);
-	strcpy(home_file,Home);
-	strcat(home_file,"/");
-	strcat(home_file,ofilename);
-	filename = home_file;
-	fd = fopen(filename,"r");
-	if(fd == 0)
+	if (Home != NULL) {
+	  home_file = safemalloc(strlen(Home) + strlen(ofilename)+3);
+	  strcpy(home_file,Home);
+	  strcat(home_file,"/");
+	  strcat(home_file,ofilename);
+	  filename = home_file;
+	  if (debugging)
+	  {
+	    fvwm_msg(DBG,"ReadSubFunc","fopen: '%s'",filename);
+	  }
+	  fd = fopen(filename,"r");
+        } else {
+          fd = 0;
+        }
+	if (fd == 0)
 	  {
 	    if((filename != NULL)&&(filename!= ofilename))
 	      free(filename);
@@ -121,6 +134,10 @@
 	    strcat(home_file,"/");
 	    strcat(home_file,ofilename);
 	    filename = home_file;
+	    if (debugging)
+	    {
+	      fvwm_msg(DBG,"ReadSubFunc","fopen: '%s'",filename);
+	    }
 	    fd = fopen(filename,"r");
 	  }
       }