bugWeeChat - Bugs: bug #37764, Security problem with untrusted...

 
 

bug #37764: Security problem with untrusted command given to hook_process in plugin API

Submitted by:  Sebastien Helleu <flashcode>
Submitted on:  Sun 18 Nov 2012 09:25:51 AM UTC  
 
Category: pluginsSeverity: 6 - Security
Item Group: securityStatus: Fixed
Privacy: PublicAssigned to: Sebastien Helleu <flashcode>
Originator Name: Open/Closed: Closed
Release: 0.3.9IRC nick: FlashCode

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 18 Nov 2012 12:32:02 PM UTC, comment #1:

Fixed in devel and new stable version 0.3.9.2 has been released.
Upgrade is HIGHLY recommended.

Workaround with a non patched version: remove/unload all scripts calling function hook_process (for maximum safety).

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Sun 18 Nov 2012 09:25:51 AM UTC, original submission:

When a plugin or script gives untrusted command to hook_process, there could be a security problem, because WeeChat uses shell to execute command.

Solution: split arguments and execute command using this array of arguments, without calling the shell. Therefore arguments are not expanded by shell.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by flashcode (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 20 Jan 2013 09:20:38 AM UTCflashcodeOpen/ClosedOpen=>Closed
    Sun 18 Nov 2012 12:32:35 PM UTCflashcodePrivacyPrivate=>Public
    Sun 18 Nov 2012 12:32:02 PM UTCflashcodeStatusIn Progress=>Fixed

    Back to the top


    Powered by Savane 3.1-cleanup