Insecure use of os.system()

[Luke Faraone]

SYNOPSIS:
       Double-clicking a file in the user's media library with
       a specially-crafted path or filename allows for
       arbitrary code execution with the permissions of the
       user running Pitivi.

STEPS TO REPRODUCE:
    1. Create a directory hierarchy like so: "images/$(xeyes)/"
    2. Place an image "hello.png" in "images/$(xeyes)/".
    2. Drag and drop "images" to the Pitivi media library.
    3. Double click the image "hello.png" in the media library

The `xeyes` program (if installed on your system) should start.

See pitivi/mainwindow.py:_mediaLibraryPlayCb().

An exploit scenario would require an attacker to provide a
specially-crafted directory hierarchy or file path. Since Pitivi does
not expose the path to the user, and a workflow of consuming content
created by others is common when working with media files, such a
scenario occurring is not hard to imagine.

[Luke Faraone (lfaraone)]

Debian has assigned a CVE; contacted GNOME Security Team.

[Tyler Hicks (tyhicks)]

Hi Luke - Thanks for reporting this issue. Is there a patch and/or coordinated release date for this issue?

[Tyler Hicks (tyhicks)]

My apologies. I now see the attached patch.

[Tyler Hicks (tyhicks)]

Precise is not affected, which is the only current Ubuntu release which has pitivi in main. Pitivi is community supported in all affected Ubuntu releases.

[Tyler Hicks (tyhicks)]

_playRenderedFileButtonClickedCb() in render.py is also likely affected in Vivid and Trusty.

[Tyler Hicks (tyhicks)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Launchpad Janitor (janitor)]

[Expired for pitivi (Ubuntu Vivid) because there has been no activity for 60 days.]

[Launchpad Janitor (janitor)]

[Expired for pitivi (Ubuntu Trusty) because there has been no activity for 60 days.]

[Launchpad Janitor (janitor)]

[Expired for pitivi (Ubuntu Wily) because there has been no activity for 60 days.]

[Launchpad Janitor (janitor)]

[Expired for pitivi (Ubuntu) because there has been no activity for 60 days.]

[Luke Faraone (lfaraone)]

Fixed in 0.95-1.