Bug 1521210 (CVE-2017-1000159) - CVE-2017-1000159 evince: Command injection when exporting to PDF
Summary: CVE-2017-1000159 evince: Command injection when exporting to PDF
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-1000159
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1521211 1521212
Blocks: 1521214
TreeView+ depends on / blocked
 
Reported: 2017-12-06 02:00 UTC by Sam Fowler
Modified: 2021-02-17 01:10 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-12-22 19:42:18 UTC


Attachments (Terms of Use)

Comment 1 Sam Fowler 2017-12-06 02:01:30 UTC
Created evince tracking bugs for this issue:

Affects: fedora-25 [bug 1521211]
Affects: fedora-26 [bug 1521212]

Comment 2 Pedro Yóssis Silva Barbosa 2017-12-22 18:43:46 UTC
I am changing the impact to moderate, once it is a vulnerability that allows command injection and the attack has a low complexity.

Comment 3 Pedro Yóssis Silva Barbosa 2017-12-22 19:16:12 UTC
This issue affects evince versions as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Enterprise Linux 5 does not have the vulnerable piece of code.

Debugging the upstream reproducer (using a file named 'lame.dvi" -D "gnome-calculator') in gdb, with a breakpoint right after the g_strdup_printf call, the formed command is a valid one:

> printf "%s", 0xf901d0      
dvipdfm -s 1, -o /tmp/evince_print.pdf.QBACBZ "/home/pedroysb/lame.dvi" -D "gnome-calculator"

However, continuing the execution, the following message appears, and the injected command is not executed:

Multiple dvi filenames?
Try "dvipdfmx --help" for more information.

This is because the dvipdfm/dvipdfmx command, as shipped in Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7, does not accept additional options that are placed after the filename (/home/pedroysb/lame.dvi). This is observed in the following piece of code (file dvipdfm.c, function do_args):

   while (argc > 0 && *argv[0] == '-') {
     /* Manipulate options */
     argc -= 1 ;
     argv += 1;
   }
   if (argc > 1) {                                                                                   
     fprintf (stderr, "\nMultiple dvi filenames?\n\n");                                              
     usage();                                                                                        
   }

Once the file name token always starts with the '"' character (i.e., never starts with the '-' character), the execution leaves the while loop, maintaining the argc value greater than 1, halting the execution (there is an exit call inside the usage function).
Therefore, we decided to do not fix this issue now (but in a future release).

Comment 4 Pedro Yóssis Silva Barbosa 2017-12-22 19:42:31 UTC
Statement:

This issue affects the versions of evince as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.