Ubuntu
firejail package

shell metacharacters mishandled

  1. Xenial (16.04)
  2. Bug #1668744
Bug #1668744 reported by Erno Kuusela
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
firejail (Ubuntu)
Fix Released
Undecided
Unassigned
Trusty
New
Undecided
Unassigned
Xenial
New
Undecided
Unassigned
Zesty
New
Undecided
Unassigned

Bug Description

I think this is a security bug, see what happens with backticks in a filename:

$ touch testfile
$ imv testfile
> testfile `touch badness`
$ firejail ls testfile*
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 23142, child pid 23143

Child process initialized
ls: cannot access 'testfile ': No such file or directory

parent is shutting down, bye...
$ ls badness
badness

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: firejail 0.9.38.10-0ubuntu0.16.04.1
ProcVersionSignature: Ubuntu 4.4.0-64.85-generic 4.4.44
Uname: Linux 4.4.0-64-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.5
Architecture: amd64
CurrentDesktop: LXDE
Date: Tue Feb 28 22:09:38 2017
Dependencies:
 gcc-6-base 6.0.1-0ubuntu1
 libc6 2.23-0ubuntu5
 libgcc1 1:6.0.1-0ubuntu1
InstallationDate: Installed on 2010-11-27 (2285 days ago)
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Release amd64 (20101007)
SourcePackage: firejail
UpgradeStatus: Upgraded to xenial on 2016-07-25 (218 days ago)
modified.conffile..etc.firejail.firefox.profile: [modified]
mtime.conffile..etc.firejail.firefox.profile: 2016-09-02T08:13:38.219464

Revision history for this message
Erno Kuusela (erno-iki) wrote :
Revision history for this message
Tyler Hicks (tyhicks) wrote :

Hi Erno - The firejail package is in universe and is, therefore, community supported. Could you please report this issue to the upstream project? Thank you!

Revision history for this message
Erno Kuusela (erno-iki) wrote :

I reported it upstream and the author replied that it has already been fixed in the latest version, apparently there has been a rewrite of the command line handling. It didn't seem like there was going to be a security advisory on his part or anything.

What's the right way to getting this fixed in Ubuntu?

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

information type: Private Security → Public Security
Changed in firejail (Ubuntu):
status: New → Incomplete
Reiner Herrmann (deki)
Changed in firejail (Ubuntu):
status: Incomplete → Fix Released
Revision history for this message
Erno Kuusela (erno-iki) wrote :

Is the "Fix Released" status correct for this bug? In https://wiki.ubuntu.com/Bugs/Bug%20statuses it says this indicates the bug is fixed in Ubuntu, but this does not seem to be the case?

Changed in firejail (Ubuntu):
status: Fix Released → Incomplete
Revision history for this message
Reiner Herrmann (deki) wrote :

Tested with latest upstream version (0.9.50) and can't reproduce the bug.
This is included in Ubuntu 17.10.

Changed in firejail (Ubuntu):
status: Incomplete → Fix Released
Revision history for this message
Erno Kuusela (erno-iki) wrote :

It's good that there is a fix in 17.10, but this remote vulnerability remains unfixed in other versions, including LTS releases. I reported this as a xenial bug (like you can see from tags) and there it remains unfixed. I'm not well versed in launchpad usage, how should this be marked in the bug status info?

tags: added: security
Changed in firejail (Ubuntu):
status: Fix Released → Incomplete
Revision history for this message
Seth Arnold (seth-arnold) wrote :

I added trusty, xenial, and zesty tasks for this bug without verifying which releases need work.

Thanks

Changed in firejail (Ubuntu):
status: Incomplete → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.