Subject: fvwm-menu-directory input checking

From: Tavis Ormandy <[email-masked]>
Date: Thu, 11 Dec 2003 12:08:28 +0000

Hi there, a Gentoo Linux user has emailed me about a bug in
fvwm-menu-directory, which could be a security problem (if you browse a
directory where someone else can create files, they can make fvwm
execute any command), This is the example they sent me:

 $ touch '
 > Exec xmessage "0wn3d"
 > '

which I confirmed using fvwm-2.5.8, this quick patch ignores the
newlines, I'm sure Mikhael will figure out the correct fix :)

--- fvwm-menu-directory.in.old  2003-12-11 11:39:10.000000000 +0000
+++ fvwm-menu-directory.in      2003-12-11 11:39:55.000000000 +0000
@@ -259,6 +259,7 @@
        $name =~ s/%/%%/g;
        $name =~ s/&/&&/g;
        $name =~ s/\*/**/g;
+       $name =~ s/\n/ /g;
        $name;
 }
 
@@ -267,6 +268,7 @@
        $name =~ s/\\/\\\\/g;
        $name =~ s/"/\\"/g;
        $name =~ s/\$/\\\$\$/g;
+       $name =~ s/\n/\\n/g;
        $name;
 }

Thanks, Tavis.

-- 
-------------------------------------
[email-masked] | finger me for my gpg key.
-------------------------------------------------------
--
Visit the official FVWM web page at <URL:http://www.fvwm.org/>.
To unsubscribe from the list, send "unsubscribe fvwm-workers" in the
body of a message to [email-masked].
To report problems, send mail to [email-masked]

---

From: Tavis Ormandy <[email-masked]>
Date: Thu, 11 Dec 2003 12:10:36 +0000

On Thu, Dec 11, 2003 at 12:08:28PM +0000, Tavis Ormandy wrote:
> fvwm-menu-directory

btw, in case you wondered why i'm getting bugreports, I maintain the
fvwm package for Gentoo, and my address is set as the local maintainer
in fvwm-bug :)

---

From: Mikhael Goikhman <[email-masked]>
Date: Fri, 12 Dec 2003 02:53:37 +0000

> newlines, I'm sure Mikhael will figure out the correct fix :)

I spent some time on this, but it seems that fvwm splits continuation
lines received from PipeRead, and it is impossible to request to preserve
the EOL character. So your fix can't be improved for now. I will think
a bit more and then apply this fix.

Regards,
Mikhael.