Bug 1521210 (CVE-2017-1000159)
| Summary: | CVE-2017-1000159 evince: Command injection when exporting to PDF | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alexl, caillon+fedoraproject, caolanm, feborges, gnome-sig, john.j5live, mclasen, mkasik, pebarbos, rhughes, rstrode, sandmann |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-12-22 19:42:18 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1521211, 1521212 | ||
| Bug Blocks: | 1521214 | ||
|
Description
Sam Fowler
2017-12-06 02:00:47 UTC
Created evince tracking bugs for this issue: Affects: fedora-25 [bug 1521211] Affects: fedora-26 [bug 1521212] I am changing the impact to moderate, once it is a vulnerability that allows command injection and the attack has a low complexity. This issue affects evince versions as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Enterprise Linux 5 does not have the vulnerable piece of code.
Debugging the upstream reproducer (using a file named 'lame.dvi" -D "gnome-calculator') in gdb, with a breakpoint right after the g_strdup_printf call, the formed command is a valid one:
> printf "%s", 0xf901d0
dvipdfm -s 1, -o /tmp/evince_print.pdf.QBACBZ "/home/pedroysb/lame.dvi" -D "gnome-calculator"
However, continuing the execution, the following message appears, and the injected command is not executed:
Multiple dvi filenames?
Try "dvipdfmx --help" for more information.
This is because the dvipdfm/dvipdfmx command, as shipped in Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7, does not accept additional options that are placed after the filename (/home/pedroysb/lame.dvi). This is observed in the following piece of code (file dvipdfm.c, function do_args):
while (argc > 0 && *argv[0] == '-') {
/* Manipulate options */
argc -= 1 ;
argv += 1;
}
if (argc > 1) {
fprintf (stderr, "\nMultiple dvi filenames?\n\n");
usage();
}
Once the file name token always starts with the '"' character (i.e., never starts with the '-' character), the execution leaves the while loop, maintaining the argc value greater than 1, halting the execution (there is an exit call inside the usage function).
Therefore, we decided to do not fix this issue now (but in a future release).
Statement: This issue affects the versions of evince as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. |