Bug 105858 – Gdm has issues with names containing shell metacharacters

Bug 105858 - Gdm has issues with names containing shell metacharacters

Summary:	Gdm has issues with names containing shell metacharacters

Status:	CLOSED RAWHIDE

Aliases:	None

Product:	Fedora
Classification:	Fedora
Component:	gdm (Show other bugs)
Sub Component:
Version:	rawhide
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Havoc Pennington
QA Contact:	Mike McLean
Docs Contact:

URL:
Whiteboard:
Keywords:	Triaged

Depends On:
Blocks:	CambridgeBlocker
	Show dependency tree / graph

Reported:	2003-09-28 10:22 EDT by Alan Cox
Modified:	2007-11-30 17:10 EST (History)
CC List:	1 user (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2003-10-21 15:51:01 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Alan Cox 2003-09-28 10:22:22 EDT

In paticular the gdm PreSession script seems to be short quoting on DISPLAY and
USER in various places that matter.

Comment 1 George Lebl 2003-09-29 17:21:33 EDT

Fixing in CVS.  Note that xdm as installed on my box (RH9) has the same issues
when it calls sessreg, I assume kdm has the same as well.  However is this truly
"exploitable"?

It would also be nice to know of any other issues such as this in GDM, is this
the only one found?

Comment 2 Alan Cox 2003-09-29 17:35:26 EDT

I've not done any kind of code review. I don't think its exploitable - you have
to have a valid username containing such characters.

Comment 3 Havoc Pennington 2003-10-21 15:51:01 EDT

We should have the fix in latest gdm packages

Note You need to log in before you can comment on or make changes to this bug.