Subject: FVWM: Security hole in FvwmM4 (?) and Manpage patch for FvwmM4

From: Raymond Toy <[email-masked]>
Date: Wed, 04 Dec 1996 10:43:27 -0500

The manpage doesn't quite format correctly for me (values for the
options don't show up).  Appended is a small patch to fix this and a
few other items.  (My knowledge of n/troff is very limited, but the
options show up as expected.)

Also, I noticed that m4 is invoked as "m4".  Could this be a security
hole?  Should the whole path be used by default, say /usr/bin/m4?  Of
course this breaks things if /usr/bin/m4 doesn't exist (like
Solaris).  However, there's always -m4prog to get the right one.

Ray

*** FvwmM4.man~	Wed May 31 08:09:31 1995
--- FvwmM4.man	Wed Dec  4 10:33:37 1996
***************
*** 33,56 ****
  in quotes, and no other quoting should be used. For example, a
  typical invocation might be
  .EX
! fvwm -f "FvwmM4 -m4-squote { -m4-equote } .fvwmrc"
  .EE
  
  Some options can be specified on the command line:
! .IP -m4-prefix
! I think this makes all the m4 directives require the prefix "m4_".
! 
! .IP -m4opt \fIoption\fP
! Lets you pass an option to the m4 program.
! 
! .IP -m4-squote \fIcharacter\fP
  Lets you change the m4 start-of-quote character to \fIcharacter\fP.
! .IP -m4-equote \fIcharacter\fP
  Lets you change the m4 end-of-quote character to \fIcharacter\fP.
! .IP -m4prog \fIname\fP
  Instead of invoking "m4", fvwm will invoke \fIname\fP.
! .IP -debug
! Causes the temporary file create by m4 to
  be retained. This file is usually called "/tmp/fvwmrcXXXXXX"

--- 33,62 ----
  in quotes, and no other quoting should be used. For example, a
  typical invocation might be
  .EX
! fvwm -cmd "FvwmM4 -m4-squote { -m4-equote } .fvwmrc"
  .EE
  
  Some options can be specified on the command line:
! .TP
! .BI -m4-prefix ""
! This option tells m4 to prefix all m4 directives with "m4_".  However,
! your version of m4 must understand the option "--prefix-builtins".
! GNU m4 understands this.
! .TP
! .BI "-m4opt" " option"
! Lets you pass \fIoption\fP to the m4 program.
! .TP
! .BI "-m4-squote" " character"
  Lets you change the m4 start-of-quote character to \fIcharacter\fP.
! .TP
! .BI "-m4-equote" " character"
  Lets you change the m4 end-of-quote character to \fIcharacter\fP.
! .TP
! .BI "-m4prog" " name"
  Instead of invoking "m4", fvwm will invoke \fIname\fP.
! .TP
! .BI "-debug" ""
! Causes the temporary file created by m4 to
  be retained. This file is usually called "/tmp/fvwmrcXXXXXX"

***************
*** 69,74 ****
--- 75,82 ----
  The operating system for CLIENTHOST.
  .IP USER
  The name of the person running fvwm.
+ .IP HOME
+ Home directory of the user.
  .IP VERSION
  The X11 version.
  .IP REVISION
***************
*** 90,96 ****
  .IP BITS_PER_RGB
  Number of bits in each rgb triplet.
  .IP CLASS
! The X11 visual class, ie PsuedoColor.
  .IP COLOR
  Yes or No, Yes if the display class is neither StaticGrey or GreyScale.
  .IP FVWM_VERSION
--- 98,104 ----
  .IP BITS_PER_RGB
  Number of bits in each rgb triplet.
  .IP CLASS
! The X11 visual class, i.e. PseudoColor.
  .IP COLOR
  Yes or No, Yes if the display class is neither StaticGrey or GreyScale.
  .IP FVWM_VERSION
***************
*** 130,134 ****
  .EE
  
  .SH AUTHOR
! FvwmM4 is the result of a random bit mutation on a hard disk,
! presumably a result of a  cosmic-ray or some such thing.
--- 138,143 ----
  .EE
  
  .SH AUTHOR
! The initial version for Fvwm 1.x was written by Raymond Toy who took
! this almost directly from twm.  Robert Nation later converted this to
! a module for Fvwm 2.
--
Visit the official FVWM web page at <URL:http://www.hpc.uh.edu/fvwm/>.
To unsubscribe from the list, send "unsubscribe fvwm" in the body of a
message to [email-masked].
To report problems, send mail to [email-masked].

---

From: Brandon Browning <[email-masked]>
Date: Wed, 04 Dec 1996 08:33:39 -0800

> Also, I noticed that m4 is invoked as "m4".  Could this be a
> security hole?  Should the whole path be used by default, say
> /usr/bin/m4?  Of course this breaks things if /usr/bin/m4 doesn't
> exist (like Solaris).  However, there's always -m4prog to get the
> right one.

Instead of breaking it (or forcing the user to remember to use
-m4prog), how 'bout making it a compile time option, configurable
from Fvwm.tmpl?  This is a no-brainer and is easy to implement.
Included are my diffs.

I haven't tested it per se, but it compiled and had the correct path
when I glanced at the binary.

-- 
Brandon M. Browning
Systems Engineer / Mailing List Maintainer
http://www.nwnet.net/

--8<------------------------------8<-----------------------------8<---

--- Fvwm.tmpl.orig	Wed Dec  4 08:21:59 1996
+++ Fvwm.tmpl	Wed Dec  4 08:19:14 1996
@@ -193,6 +193,13 @@

 /***************************************************************************
+ * Where M4 is located for FvwmM4.  Leave undefined if you don't have M4 or
+ * the M4 is in /usr/bin/m4
+ ***************************************************************************/
+/* #define M4Binary /usr/local/bin/m4 */
+
+
+/***************************************************************************
  * End of configuration items.  You shouldn't need to edit below here...
  ***************************************************************************/
 
@@ -284,6 +291,12 @@
         FVWMDIR = FvwmDir
 #else
         FVWMDIR = $(LIBDIR)/FvwmName
+#endif
+
+#ifdef M4Binary
+	M4 = M4Binary
+#else
+	M4 = /usr/bin/m4
 #endif
 
 #ifndef FvwmIconPath
--- modules/FvwmM4/Imakefile.orig	Wed Dec  4 08:21:06 1996
+++ modules/FvwmM4/Imakefile	Wed Dec  4 08:19:41 1996
@@ -12,6 +12,6 @@
 
 FvwmModuleTarget(FvwmM4)
 
-PATH_DEFINES = -DFVWMDIR=\"$(FVWMDIR)\"
+PATH_DEFINES = -DFVWMDIR=\"$(FVWMDIR)\" -DM4=\"$(M4)\"
 
 SpecialObjectRule(FvwmM4.o, $(FVWM_SRCDIR)/Fvwm.tmpl FvwmM4.c, $(PATH_DEFINES))
--- modules/FvwmM4/FvwmM4.c.orig	Wed Dec  4 08:11:36 1996
+++ modules/FvwmM4/FvwmM4.c	Wed Dec  4 08:12:08 1996
@@ -63,7 +63,7 @@
 int  m4_enable;                 /* use m4? */
 int  m4_prefix;                 /* Do GNU m4 prefixing (-P) */
 char m4_options[BUFSIZ];        /* Command line options to m4 */
-char *m4_prog = "m4";           /* Name of the m4 program */
+char *m4_prog = M4;             /* Name of the m4 program */
 int  m4_default_quotes;         /* Use default m4 quotes */
 char *m4_startquote = "`";         /* Left quote characters for m4 */
 char *m4_endquote = "'";           /* Right quote characters for m4 */      
--
Visit the official FVWM web page at <URL:http://www.hpc.uh.edu/fvwm/>.
To unsubscribe from the list, send "unsubscribe fvwm" in the body of a
message to [email-masked].
To report problems, send mail to [email-masked].

---

From: [email-masked] (David S. Goldberg)
Date: 04 Dec 1996 12:03:46 -0500

Before anyone makes any "fixes", please explain why this is even
considered a security hole.  Frankly I don't see it.  It's not like
FvwmM4 is being run setuid to root (or anyone else).  If fvwm is
started from a shell prompt, or a .xinitrc file, then presumably the
user's path will be properly set for what the user believes is the
correct m4 program.  If an attacker can modify the directories in that
user's path such that a different m4 is run then the attacker has got
that user hosed already and nothing can be done to FvwmM4 that will
help the user.  If fvwm is started from xdm or dtlogin and the user's
path is not set, then only system directories should be available, and
if none of those contains m4 then the user will probably get an error
message and figure out how to fix it :-) If an attacker can modify
those system directories, then the attacker has root and the game's
over.

In short, I don't see allowing m4 to be determined by PATH to be a
security hole in this particular case.  If there's something else I'm
missing, I'd be glad to know of it.

Thanks,

--
Dave Goldberg
Post: The Mitre Corporation\MS B305\202 Burlington Rd.\Bedford, MA 01730
Phone: 617-271-3887
Email: [email-masked]

---

From: Brandon Browning <[email-masked]>
Date: Wed, 04 Dec 1996 10:58:25 -0800

> FvwmM4 is being run setuid to root (or anyone else).

But what if you _are_ root?  Before anyone goes stomping on me telling
me I'm an idiot to run X as root, let me say that I was forced into it
by the OS and no, I don't do it anymore.

True, 99.95% of the userbase will most likely never do this (unless
they have a death wish or are truly oblivious to pain), but of course,
99.95% of the people aren't trying to crack into the system.  And the
truly clueless (it happens to all of us) wouldn't think about this
kind of hole, so why leave it open?

I've fixed my sources -- but I'm not going to twist your arm to fix
yours. :)

---

From: [email-masked] (David S. Goldberg)
Date: 04 Dec 1996 15:41:35 -0500

> But what if you _are_ root?

Then so what?  If you, as root, are vulnerable to a trojan version of
m4, then either you've allowed someone write access to directories you
trust, you've allowed someone to write to your .profile (thus giving
you a PATH you didn't expect) or the attacker found some other way to
break root and won't be wasting her time putting a different version
of m4 in your path -- she'd just replace the standard one.