Full Disclosure mailing list archives
a2ps executing shell commands from file name
From: Rudolf Polzer <divzero () gmail com>
Date: Tue, 24 Aug 2004 13:01:47 +0200
Severity: Medium Short description: a2ps executes arbitrary shell commands from a given file name Affected: GNU a2ps 4.13, a nice syntax-highlighting formatter from source code to postscript Operating systems: all systems where a2ps 4.13 compiles and which have a bourne or C shell by default used by system(). On other systems the patch might not work while the problem is probably still there. Description: a2ps can execute shell commands from file names. Not really severe, unless you use a2ps with wildcards from a world-writable directory like /tmp. I've also seen someone using a2ps in a pure-ftpd upload script which is executed after successful upload of a file. Workaround: Do not use wildcards in a2ps command lines except if you do that in a directory only you can create files in and where you know the contents. This might also apply to other tools (I did not check them), so be careful. How to reproduce: $ touch 'x`echo >&2 42`.c' $ a2ps -o /dev/null *.c 42 [x`echo >&2 42`.c (C): 0 pages on 0 sheets] [Total: 0 pages on 0 sheets] saved into the file `/dev/null' $ a2ps -V GNU a2ps 4.13 Written by Akim Demaille, Miguel Santana. How I found it: $ touch 'LAN (div0)' $ a2ps -o /dev/null LAN* sh: -c: line 1: syntax error near unexpected token `(' sh: -c: line 1: `/usr/bin/file -L LAN (div0)' [LAN (div0) (plain): 0 pages on 0 sheets] [Total: 0 pages on 0 sheets] saved into the file `/dev/null' How I fixed it: http://www.freebsd.org/cgi/cvsweb.cgi/~checkout~/ports/print/a2ps-letter/files/patch-select.c?rev=1.1&content-type=text/plain Patch status: Except for FreeBSD, no distribution seems to currently have the patch (I sent it in to the FreeBSD people, the Debian a2ps maintainer "mhatta at debian dot org" and "bug-a2ps at gnu dot org" at the same time using Cc:). The patch might not work on Windows while the problem seemingly still exists when command.com is used as shell interpreter (but it might require a prepared floppy). The file name for exploiting it may be different, however. MS-DOS probably is safe. I cannot think of anything malicious that you can do in eight characters. However, a prepared floppy could contain a file named a|foo|.txt and a foo.bat containing "what you want". Well, anyway, I do not know if a2ps runs on DOS at all. -- / --- Where bots rampage, I'm there to take them down! --- \ / ------ Where trouble arises, I'm there to cause it! ------ \ \ Where an enemy tries to frag me, victory will be mine!!!1! / {{dup[exch{dup exec}fork =}loop}dup exec >> http://www.ccc-offenbach.org << _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- a2ps executing shell commands from file name Rudolf Polzer (Aug 24)