Insecure use of perl exec()

[prajith]

This vulnerability is almost same as CVE-2015-0854. If you click "Run a plugin" option while viewing a file with a specially-crafted filename allows arbitrary code execution with the permissions
of the user running Shutter.

STEPS TO REPRODUCE:
   1) Rename an image to something like "$(firefox)"
   2) Open the renamed file in shutter
   3) Click the "Run a plugin" option and select any plugin from the list and click "Run"

   You should see firefox browser opened as separate process.

In line 7571-7572:/usr/bin/shutter

  $session_screens{$key}->{'filetype'} = $session_screens{$key}->{'short'};
  $session_screens{$key}->{'filetype'} =~ s/.*\.//ig;

if the file doesn't any have extension, $session_screens{$key}->{'filetype'} simply returns the actual filename instead of "undef".

In line 7163:/usr/bin/shutter

exec( sprintf( "$^X $plugin_value %d $qfilename $session_screens{$key}->{'width'} $session_screens{$key}->{'height'} $session_screens{$key}->{'filetype'}\n", $socket->get_id ) );

by passing unescaped shell characters "$session_screens{$key}->{'filetype'}" to exec function, it directly gets executed as current running user.

[prajith (prajithpalakkuda)]

CVE-2016-10081 id has been assigned for tracking this vulnerability.

[Jsegitz-i (jsegitz-i)]

CVE-2016-10081

/usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote attackers
to execute arbitrary commands via a crafted image name that is mishandled during
a "Run a plugin" action.

Details in https://bugs.launchpad.net/shutter/+bug/1652600

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10081
https://bugs.launchpad.net/shutter/+bug/1652600

[Swamp-a (swamp-a)]

bugbot adjusting priority

[Dominique Dumont (domi-dumont)]

I've prepared a new package on Debian to fix this issue and secure other system() calls.

This will be uploaded soon to Debian unstable

All the best

[Dominique Dumont (domi-dumont)]

Here's the patch to secure remaining system() calls:

https://anonscm.debian.org/cgit/collab-maint/shutter.git/tree/debian/patches/fix-perl-system-calls

[Dominique Dumont (domi-dumont)]

I forgot to mention the patch to CVE-2016-10081 which must be applied before the patch mentioned above.

https://anonscm.debian.org/cgit/collab-maint/shutter.git/tree/debian/patches/CVE-2016-10081.patch

You may also want to apply all Debian patches. They fix problems that are not specific to Debian:

https://anonscm.debian.org/cgit/collab-maint/shutter.git/tree/debian/patches

HTH

[Matthias Mailänder (mailaender)]

https://build.opensuse.org/request/show/449244

[Matthias Mailänder (mailaender)]

https://build.opensuse.org/request/show/449568

[Andreas Stieger (andreasstieger)]

42.2 was missing

[Bwiedemann (bwiedemann)]

This is an autogenerated message for OBS integration:
This bug (1017571) was mentioned in
https://build.opensuse.org/request/show/516218 42.2+42.3 / shutter

[Michael Kogan (michael-kogan)]

Applied Debian's patch in rev.1282.

[Michael Kogan (michael-kogan)]

Sorry, mistook this for CVE-2015-0854 (which is mentioned in the first line). Will now apply the patches fixing CVE-2016-10081.

[Michael Kogan (michael-kogan)]

Applied all Debian patches besides of "fix-perl-system-calls" so far, looks like I am too stupid to use patch properly.

[Andreas Stieger (andreasstieger)]

done

[Swamp-a (swamp-a)]

openSUSE-SU-2017:2207-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1017571
CVE References: CVE-2016-10081
Sources used:
openSUSE Leap 42.3 (src): shutter-0.93.1-5.1
openSUSE Leap 42.2 (src): shutter-0.93.1-2.3.1

[Michael Kogan (michael-kogan)]

Applied the remaining patch from https://salsa.debian.org/perl-team/modules/packages/shutter/blob/master/debian/patches/fix-perl-system-calls by hand in rev. 1298.