Red Hat Bugzilla – Bug 1521210
CVE-2017-1000159 evince: Command injection when exporting to PDF
Last modified: 2017-12-22 14:44:36 EST
Command injection in evince via malicious filename when printing to PDF. This affects versions earlier than 3.25.91. References: https://nvd.nist.gov/vuln/detail/CVE-2017-1000159 https://bugzilla.gnome.org/show_bug.cgi?id=784947 https://security-tracker.debian.org/tracker/CVE-2017-1000159 https://git.gnome.org/browse/evince/commit/?id=350404c76dc8601e2cdd2636490e2afc83d3090e
Created evince tracking bugs for this issue: Affects: fedora-25 [bug 1521211] Affects: fedora-26 [bug 1521212]
I am changing the impact to moderate, once it is a vulnerability that allows command injection and the attack has a low complexity.
This issue affects evince versions as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Enterprise Linux 5 does not have the vulnerable piece of code. Debugging the upstream reproducer (using a file named 'lame.dvi" -D "gnome-calculator') in gdb, with a breakpoint right after the g_strdup_printf call, the formed command is a valid one: > printf "%s", 0xf901d0 dvipdfm -s 1, -o /tmp/evince_print.pdf.QBACBZ "/home/pedroysb/lame.dvi" -D "gnome-calculator" However, continuing the execution, the following message appears, and the injected command is not executed: Multiple dvi filenames? Try "dvipdfmx --help" for more information. This is because the dvipdfm/dvipdfmx command, as shipped in Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7, does not accept additional options that are placed after the filename (/home/pedroysb/lame.dvi). This is observed in the following piece of code (file dvipdfm.c, function do_args): while (argc > 0 && *argv[0] == '-') { /* Manipulate options */ argc -= 1 ; argv += 1; } if (argc > 1) { fprintf (stderr, "\nMultiple dvi filenames?\n\n"); usage(); } Once the file name token always starts with the '"' character (i.e., never starts with the '-' character), the execution leaves the while loop, maintaining the argc value greater than 1, halting the execution (there is an exit call inside the usage function). Therefore, we decided to do not fix this issue now (but in a future release).
Statement: This issue affects the versions of evince as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.