shell metacharacters mishandled

[Erno Kuusela]

I think this is a security bug, see what happens with backticks in a filename:

$ touch testfile
$ imv testfile
> testfile `touch badness`
$ firejail ls testfile*
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 23142, child pid 23143

Child process initialized
ls: cannot access 'testfile ': No such file or directory

parent is shutting down, bye...
$ ls badness
badness

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: firejail 0.9.38.10-0ubuntu0.16.04.1
ProcVersionSignature: Ubuntu 4.4.0-64.85-generic 4.4.44
Uname: Linux 4.4.0-64-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.5
Architecture: amd64
CurrentDesktop: LXDE
Date: Tue Feb 28 22:09:38 2017
Dependencies:
 gcc-6-base 6.0.1-0ubuntu1
 libc6 2.23-0ubuntu5
 libgcc1 1:6.0.1-0ubuntu1
InstallationDate: Installed on 2010-11-27 (2285 days ago)
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Release amd64 (20101007)
SourcePackage: firejail
UpgradeStatus: Upgraded to xenial on 2016-07-25 (218 days ago)
modified.conffile..etc.firejail.firefox.profile: [modified]
mtime.conffile..etc.firejail.firefox.profile: 2016-09-02T08:13:38.219464

[Tyler Hicks (tyhicks)]

Hi Erno - The firejail package is in universe and is, therefore, community supported. Could you please report this issue to the upstream project? Thank you!

[Erno Kuusela (erno-iki)]

I reported it upstream and the author replied that it has already been fixed in the latest version, apparently there has been a rewrite of the command line handling. It didn't seem like there was going to be a security advisory on his part or anything.

What's the right way to getting this fixed in Ubuntu?

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Erno Kuusela (erno-iki)]

Is the "Fix Released" status correct for this bug? In https://wiki.ubuntu.com/Bugs/Bug%20statuses it says this indicates the bug is fixed in Ubuntu, but this does not seem to be the case?

[Reiner Herrmann (deki)]

Tested with latest upstream version (0.9.50) and can't reproduce the bug.
This is included in Ubuntu 17.10.

[Erno Kuusela (erno-iki)]

It's good that there is a fix in 17.10, but this remote vulnerability remains unfixed in other versions, including LTS releases. I reported this as a xenial bug (like you can see from tags) and there it remains unfixed. I'm not well versed in launchpad usage, how should this be marked in the bug status info?

[Seth Arnold (seth-arnold)]

I added trusty, xenial, and zesty tasks for this bug without verifying which releases need work.

Thanks