Insecure use of system() allows arbitrary code execution via "Show in Folder"
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Shutter |
Fix Released
|
Undecided
|
Unassigned | ||
| shutter (Debian) |
Fix Released
|
Unknown
|
|||
| shutter (Ubuntu) |
Fix Released
|
Medium
|
Unassigned | ||
Bug Description
Using the "Show in folder" menu option while viewing a file with a specially-crafted path allows for arbitrary code execution with the permissions of the user running Shutter.
STEPS TO REPRODUCE:
1. Put an image in a folder called "$(xeyes)"
2. Open the image in Shutter
3. Right-click the image and click "Show in Folder"
The `xeyes` program (if installed on your system) should start.
Lines 54-65 of share/shutter/
sub xdg_open {
my ( $self, $dialog, $link, $user_data ) = @_;
Because `system` is used, the string is scanned for shell
metacharacters[1], and if found the string is executed using a shell.
[1]: http://
CVE-2015-0854 has been assigned for this issue by the Debian Security Team.
CVE References
| Luke Faraone (lfaraone) wrote | #1 |
| information type: | Private Security → Public Security |
| Changed in shutter (Ubuntu): | |
| status: | New → Triaged |
| importance: | Undecided → Medium |
| Changed in shutter (Debian): | |
| status: | Unknown → Confirmed |
| tags: | added: patch |
| Robin Lee (cheeselee) wrote | #2 |
| Robin Lee (cheeselee) wrote | #3 |
| Changed in shutter (Debian): | |
| status: | Confirmed → Fix Released |
| Launchpad Janitor (janitor) wrote | #4 |
| Changed in shutter (Ubuntu): | |
| status: | Triaged → Fix Released |
| Michael Kogan (michael-kogan) wrote | #5 |
| Changed in shutter: | |
| status: | New → Fix Committed |
| Changed in shutter: | |
| milestone: | none → 0.94 |
| Changed in shutter: | |
| status: | Fix Committed → Fix Released |
Luke's patch is not 'strict'. '@args' should have a 'my' declaration.