cron.daily/aide incorrectly handles certain filenames

[David Duffey]

Binary package hint: aide

My "Daily AIDE report" reported the following:

-- snip --

The following software updates were detected and were filtered from this list:
coreutils

-- snip--

yet it did not filter the files in the package list like it was supposed to, for example, it still reported these to changes:

changed: /usr/share/man/man1/[.1.gz
changed: /usr/bin/[

Which caused /etc/cron.daily/aide to bomb with the following error:

-- snip --
Anacron job 'cron.daily' on cylon
/etc/cron.daily/aide:
grep: Unmatched [ or [^
grep: Unmatched [ or [^
-- snip --

As you can see, the aide shell script is reading the name of a file that include's a left square bracket and grep is trying to interpret that as a regular expression. I narrowed down the problem to two lines here:

/etc/cron.daily/aide:328: if [ -z "$(grep "^${BASH_REMATCH[2]}$" "$FILTERTMP3")" ]; then

and

/etc/cron.daily/aide:350: < "$NOISETMP2" grep -v "^\(changed\|removed\|added\): $NOISE" >> "$NOISETMP"

Those two lines should be fixed such that the bash variables escape any regular expressions before passed to grep.

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: aide-common 0.13.1-11ubuntu2
ProcVersionSignature: Ubuntu 2.6.32-25.44-generic 2.6.32.21+drm33.7
Uname: Linux 2.6.32-25-generic x86_64
NonfreeKernelModules: nvidia
Architecture: amd64
Date: Mon Oct 11 10:50:37 2010
InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release amd64 (20100429)
PackageArchitecture: all
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: aide

[David Duffey (dduffey)]

grep has a -F option to search for a fixed string, which would work for line 328, but I am not sure how you would accomplish the same thing for line 350 which has a valid regular expression and then a filename that should be treated as a fixed string.

[Kees Cook (kees)]

Thanks for this report! It seems like it is only a regex is under control. I don't immediately see a way that this could result in arbitrary code execution. It certain could be used to alter report results, and should be fixed, but I wanted to see if you had examples for how it could be used for arbitrary code execution.

[David Duffey (dduffey)]

Kees, you are correct. I noticed the mistake in the title after I created the report, but didn't seem to be able to edit the title.

Thanks