Bug 31520 - db2XXX scripts have unsecure parameter passing
Summary: db2XXX scripts have unsecure parameter passing
Status: CLOSED RAWHIDE
Alias: None
Product: Red Hat Raw Hide
Classification: Retired
Component: docbook-utils
Version: 1.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Tim Waugh
QA Contact:
URL:
Whiteboard:
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2001-03-12 17:04 UTC by matti aarnio
Modified: 2008-05-01 15:38 UTC (History)
0 users

(edit)
Clone Of:
(edit)
Last Closed: 2001-03-12 17:08:43 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description matti aarnio 2001-03-12 17:04:06 UTC 
package: docbook-utils-0.6-11

The  db2pdf(*),  db2dvi, db2ps, and db2rtf are all of
style:

#! /bin/sh
jw -f docbook -b rtf $*

while they should be:

#! /bin/sh
jw -f docbook -b rtf "$*"

in case any of the passed options have IFS characters in them...

(*) The db2pdf is at package  docbook-utils-pdf  which isn't listed at RH
component dataset.
Comment 1 Tim Waugh 2001-03-12 17:08:38 UTC 
(ITYM "$@".)  Thanks for spotting it.
Comment 2 Tim Waugh 2001-03-12 18:42:38 UTC 
Fixed in docbook-utils-0.6-12 in rawhide, although I don't think it's really a 
security issue.
Note You need to log in before you can comment on or make changes to this bug.