breakage and possible execution of unsafe code with shell metacharacters

[James Michael Fultz]

Binary package hint: system-tools-backends

The function Utils::File::run_backtick() (from '/usr/share/system-tools-backends-2.0/scripts/Utils/File.pm') accepts a single argument of a string which is later parsed into a command and arguments by splitting on blanks. This causes breakage whenever an argument itself contains blanks or other shell metacharacters and can even lead to the unintended execution of shellcode.

A real-world example of breakage is when entering an SSID or encryption key containing blanks or other shell metacharacters via network-admin from gnome-system-tools. It is even unsecure since unsafe shellcode could be injected by way having an SSID such as "My SSID; rm -rf /".

[Jamie Strandboge (jdstrand)]

Network/Ifaces.pm contains:

  # FIXME: not good to pass directly keys to processes,
  # probably the network one won't be so important
  # to keep secret to other users.
  $output = &Utils::File::run_backtick ("wpa_passphrase $essid $key");

Confirmed $key and $essid are user controllable. Checked other occurrences of run_backtick(), and arguments are not user controllable. Users/Groups.pm doesn't do checking either, blackbox testing indicates the front-end does.

[Jamie Strandboge (jdstrand)]

Unflagging as private, as the impact is low-- you need to have admin rights to run network-admin.

[Milan Bouchet-Valat (nalimilan)]

In the system-tools-backends 2.8.2, we no longer start programs using the shell. Arguments are sent directly, which avoids this kind of problem.

[Milan Bouchet-Valat (nalimilan)]

Woops... actually, run_backtick() has not been switched to that, it would be quite complex in perl. I guess we won't fix that before network-admin is considered as completely deprecated...

[Jamie Strandboge (jdstrand)]

system-tools-backends is no longer in main and has been deprecated. I am going to leave this bug open for now, but unsubscribing ubuntu-security.