Shell injection with a GTK-Bookmark

[Bernd Dietzel]

Shell Commands can be injected
when the file ~/.gtk-bookmarks contains for example a path like this :

/temp/$(xeyes)/test/

In the settings of the mate-menu the option to show the gtk-bookmarks in the places must be checked to make it work.

See attached screenshot.

Reason is this os.system call ...

File : /usr/share/mate-menu/plugins/places.py
os.system("caja \"%s\" &" % path)

... which should be better replaced with subprocess.

Thank you :-)

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: mate-menu 5.7.1-1
ProcVersionSignature: Ubuntu 4.4.0-22.40-generic 4.4.8
Uname: Linux 4.4.0-22-generic i686
ApportVersion: 2.20.1-0ubuntu2
Architecture: i386
CurrentDesktop: MATE
Date: Fri May 27 12:30:35 2016
InstallationDate: Installed on 2016-01-10 (137 days ago)
InstallationMedia: Linux 15.10 - Release i386
PackageArchitecture: all
SourcePackage: mate-menu
UpgradeStatus: Upgraded to xenial on 2016-05-07 (20 days ago)

[Bernd Dietzel (l-ubuntuone1104)]

...and Remove this os.system calls, too please :-)

/usr/share/mate-menu/plugins/recent.py:189:
x = os.system("gvfs-open \""+filename+"\"")

/usr/share/mate-menu/plugins/applications.py:991:
os.system("rm \"%s\" &" % desktopEntry.desktopFile)

/usr/share/mate-menu/plugins/applications.py:1095: os.system(fullstring + " &")

[Launchpad Janitor (janitor)]

This bug was fixed in the package mate-menu - 17.10.2-0ubuntu1

---------------
mate-menu (17.10.2-0ubuntu1) artful; urgency=medium

  * New upstream release. (LP: #1586346)

 -- Martin Wimpress <email address hidden> Fri, 19 May 2017 12:17:51 +0100