Bug 493157 - rpmbuild allows names and versions/releases like: ../../../
rpmbuild allows names and versions/releases like: ../../../
Product: Fedora
Classification: Fedora
Component: rpm (Show other bugs)
All Linux
high Severity high
: ---
: ---
Assigned To: Jindrich Novy
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2009-03-31 16:02 EDT by seth vidal
Modified: 2013-07-28 21:57 EDT (History)
8 users (show)

See Also:
Fixed In Version: 4.6.1-1.fc10
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-06-04 17:11:12 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description seth vidal 2009-03-31 16:02:25 EDT
Description of problem:
look at this spec:

build that spec.
note where the files end up being written/built.

cry softly into your keyboard when you think about %clean

so I think maybe ~, /, and .. among anything else you can think of need to be stricken from pkg name/ver/rel fields?
Comment 1 Jindrich Novy 2009-04-06 04:23:43 EDT
Fixed upstream.

~,/ and .. are no more permitted in NVR.
Comment 4 Panu Matilainen 2009-04-09 09:10:26 EDT
Fixed in rawhide now, keeping open for F10 tracking.
Comment 5 Tomas Hoger 2009-04-09 09:25:06 EDT
Removing group restriction.
Comment 6 Jeff Johnson 2009-04-09 17:00:31 EDT
FYI: the issue of  wild characters in Name: was reported to a vendor-sec representative
in December and fixed @rpm5.org by adding PCRE validation patterns for all tags, not
just spot checking NVR. The issue is considerably more complex than, say,
   Name: ~;
and can be exercised by any script, not just rpmbuild, that constructs file paths
from RPM package tags.

Not that vendor-sec is worth much these days ...
Comment 7 Jeff Johnson 2009-04-10 15:10:30 EDT
Um, these issues are hardly fixed by preventing '/' and '~' and '..'.

After 30 minutes of dinking, there are (some) of the flaws I found (note
that I'm not even a professional "black hat", I'm quite sure that
additional paranoia and malice might have reduced 30 minutes
to something much less).

For starters, ~ is unnecessary when
   Name: whatever;cd;
is possible.

And there are eval contexts with '<' available that make
failing a build if/when a '/' is present pointless:

    Name: whatever;cd;cat<$SHELL>$'057'tmp$'057'myshell

Note that similar but much more serious exploits are possible
using /dev/tcp/HOSTNAME/PORT importing (and executing) a rootkit.

I suggest that you commit to permitted character sets in specific tag contents
and undertake explicit verification rather than fooling yourself with silliness like

    But you can't mention '/' or '~' or ".." in name/version/release!

instead. It really isn't __THAT__ hard to add an explicit permitted character set
in tag content like RPMTAG_NAME and RPMTAG_VERSION etc etc.

YMMV. Have fun!
Comment 8 Fedora Update System 2009-05-18 07:48:58 EDT
rpm-4.6.1-1.fc10 has been submitted as an update for Fedora 10.
Comment 9 Fedora Update System 2009-05-19 20:53:37 EDT
rpm-4.6.1-1.fc10 has been pushed to the Fedora 10 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update rpm'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F10/FEDORA-2009-5214
Comment 10 Fedora Update System 2009-06-04 17:11:01 EDT
rpm-4.6.1-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.