#1053373 winff: shell injection

Package:
winff
Source:
winff
Submitter:
Jakub Wilk
Date:
2024-02-25 10:09:04 UTC
Severity:
normal
Tags:
#1053373#3
Date:
2023-10-02 19:57:43 UTC
From:
To:
WinFF doesn't correctly escape filenames that it passes to shell. If the
user is tricked to convert files with malicious names, this could result
in execution of arbitrary code.

To reproduce, try converting the file created by this command:

   touch '$(cowsay pwned >&2; sleep inf).mp3'
#1053373#10
Date:
2023-10-05 17:04:27 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
winff, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1053373@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Peter Blackman <peter@pblackman.plus.com> (supplier of updated winff package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 05 Oct 2023 10:00:00 +0100
Source: winff
Architecture: source
Version: 1.6.2+dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Pascal Packaging Team <pkg-pascal-devel@lists.alioth.debian.org>
Changed-By: Peter Blackman <peter@pblackman.plus.com>
Closes: 759980 1053373
Changes:
 winff (1.6.2+dfsg-2) unstable; urgency=medium
 .
   * Temporary home directory to run soffice (Closes: #759980)
   * Build dependencies (for javaldx)
   * Escape Dollar signs in file names (Closes: #1053373)
Checksums-Sha1:
 7f6063d8d59edd27251310669c5d38af2aa252e8 2092 winff_1.6.2+dfsg-2.dsc
 d67939a48d7dbd5bb7cf71fce3b09e6d1a8565ac 83424 winff_1.6.2+dfsg-2.debian.tar.xz
 13f59276691ea40df4ab3a96c6b768011c29c794 5427 winff_1.6.2+dfsg-2_source.buildinfo
Checksums-Sha256:
 af64642448bfa1e1eb723dffcd2fa90ea11508c6b5a9e37746626bcba56a9ebd 2092 winff_1.6.2+dfsg-2.dsc
 169466d77d8d153493b9f09e31fe85ed5b7f2ecde5188a5c809fed5f56a42ff0 83424 winff_1.6.2+dfsg-2.debian.tar.xz
 8cd8dd0ee6272e8c3f1a9f3e44e9b01c8472090a36deae4663e5f272f641bdfc 5427 winff_1.6.2+dfsg-2_source.buildinfo
Files:
 bdf9d8b01dd261badd1879b64fc327db 2092 video optional winff_1.6.2+dfsg-2.dsc
 bed8bd9d5230c5328dcc5ff0d5243334 83424 video optional winff_1.6.2+dfsg-2.debian.tar.xz
 24a2a8bfa19a3c22254114f1302935ae 5427 video optional winff_1.6.2+dfsg-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmUe6usQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFL2eDACIF9K7fXW1qbiyU7KULOWkpwN9RA+S0m+a
Dg8VdcYou4qSSEHbZ+ciIxEO6MbeTgxCEwX1QTYZRcrULwpEFYXGLKOhdI4Zbs5m
iDHRVIAz4U75z6Zq1Le5U9p8So8RLBroPrvSvaVLAA5KzzrPudjz0x+VxQUf6lEv
CoHNTRQvXobT6y7JvmvlsHuwtRSzLCyB/9/kzk9R194LtEDG1wI1iprQON5bxYD0
u8LYbl5oE5LFUKck7Rp1XqX6eMxa58iT4scFamOIkoB2SeZRlRZEs3tK+N5kW1xz
tpLhgjqGv0rTSpnhVVjujQh3kUN5A4ayMy7yRDs+0dv4Ir58i5hA5WqD1pXyuIbW
Uss0EQF/0gaGqGNFmvxR7yqm71u+4qqara/oI0oYjAl7hqdh07hQy6mZvXP3tS59
dZNWS0oY8olT0dtj2zYu93/swTCb4mRlWPWt1e8U2wDRjlbxz7WXwiCEFXcwqfO4
V/a5NW5JQ77E75+BM7vSGZHTJxIEe9A=
=n6Db
-----END PGP SIGNATURE-----
#1053373#17
Date:
2024-01-26 21:45:28 UTC
From:
To:
The fix is insufficient. To reproduce, try converting the file created
by this command:

     touch '`cowsay pwned >&2; sleep inf`.mp3'

Single-quoted strings are better suited for shell-escaping, because the
only character to care of is the single quote itself. That is, the whole
escaping procedure could look like this:

1) Replace every ' character with: '\''

2) Add single quotes around the whole thing.
#1053373#24
Date:
2024-02-19 14:36:07 UTC
From:
To:
On Fri, 26 Jan 2024 22:45:28 +0100 Jakub Wilk <jwilk@jwilk.net> wrote:
 > Control: found -1 1.6.2+dfsg-2
 >
 > The fix is insufficient. To reproduce, try converting the file created
 > by this command:
 >
 > touch '`cowsay pwned >&2; sleep inf`.mp3'
 >
I'm now escaping backticks. This fixes the issue with above file.


 > Single-quoted strings are better suited for shell-escaping, because the
 > only character to care of is the single quote itself. That is, the whole
 > escaping procedure could look like this:
 >
 > 1) Replace every ' character with: '\''
 >
 > 2) Add single quotes around the whole thing.
 >

Noted. Thanks for the suggestion.

However, I'm wary of a more invasive change, and more divergence between
Linux & Windows codepaths, so have stuck with the simpler solution for now.


Regards,
Peter
#1053373#29
Date:
2024-02-25 10:04:49 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
winff, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1053373@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Peter Blackman <peter@pblackman.plus.com> (supplier of updated winff package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 19 Feb 2024 13:00:00 +0000
Source: winff
Built-For-Profiles: noudeb
Architecture: source
Version: 1.6.3+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Pascal Packaging Team <pkg-pascal-devel@lists.alioth.debian.org>
Changed-By: Peter Blackman <peter@pblackman.plus.com>
Closes: 1053373 1061586
Changes:
 winff (1.6.3+dfsg-1) unstable; urgency=medium
 .
   * New Upstream release (Closes: #1053373) (Closes: #1061586)
   * Drop patch adopted upstream
   * Update copyright date
Checksums-Sha1:
 d55265c3de46b30ee868b3cf9ca6ef3583488913 2242 winff_1.6.3+dfsg-1.dsc
 96844a0e3cdc6ec1789d7455974eb9dbb00fb826 2687816 winff_1.6.3+dfsg.orig.tar.xz
 649c90126b561265b6d5ec59332ad3a4e6bb7bd9 83080 winff_1.6.3+dfsg-1.debian.tar.xz
 136c7f2e07fd1aacf3e9d9f7dd7f482e4efce5f9 14274 winff_1.6.3+dfsg-1_source.buildinfo
Checksums-Sha256:
 3d1e1b6bcdedf1c4ab8a480714de0f7ab92cf376121151db04b71ca8876465b0 2242 winff_1.6.3+dfsg-1.dsc
 786e410b8ef24138700d64d250233738bf2a0b8809a0f20c2efe0f628dd43ae1 2687816 winff_1.6.3+dfsg.orig.tar.xz
 3bac0a7627d979b684375e974a9468440f324ff47868e1bdec149c951dfd6e67 83080 winff_1.6.3+dfsg-1.debian.tar.xz
 3e60ca7441351a1910ba99f681b68d0287af217446b9a421399e35a8200a4abf 14274 winff_1.6.3+dfsg-1_source.buildinfo
Files:
 050235e0ca913e7c18b3716d4286ef09 2242 video optional winff_1.6.3+dfsg-1.dsc
 6867fb322626d5df2067d8bc5ae8fa19 2687816 video optional winff_1.6.3+dfsg.orig.tar.xz
 4b9f0f15fa7f4c0ad9c8506eeb1ea0ff 83080 video optional winff_1.6.3+dfsg-1.debian.tar.xz
 a807a6885643cf0d3bcbb612069394e2 14274 video optional winff_1.6.3+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEkpeKbhleSSGCX3/w808JdE6fXdkFAmXbDpEACgkQ808JdE6f
XdmpCQ/+Od00cEalnyCxN+E5OpUn4EB0gnxQcUQsHMpJVhphMds4EEzxK/vecC48
REOVolyD+LwbEkWniRDeW2E0LCDdYbi7SuUX79Vr3aaequHt0O6l71Ii4KMglgyV
rNRTOwckMQ2esMFOhsiWcmfPPyBKJoJoWLr9PDkskX+iEYVmyqJ91tdL5cflHc+Q
kaIY1TEkPZ4xWU1UCEisNni6booOMxha7HGFfbtJh6TEchLEhW/gztHxlNvJNJeR
HYLcbvq2calb54IV91Ix0bx/VVZS0kavk3zPD46En77sZNgGU+TavKgce+tGml4K
6tp8T7NX18/sPgJ73iRn9Qw0wiH/uiUo1XfCtPBbGLXsO57AmoEayDYqyd8FYcyG
/+zmytcbqJZKNSXw+0exzc0B0OS5xibMNEwLdWCQoJqBMJtYwUOT1Jr2qaFNEGfT
V1NCmO1iqDoZWXeLPx8Hp0SwTA5jSNys7k106urgJz0sz9gZVTIF8LYSRY1W9qXs
QxiZ/z6PUWhByiejMdy2NAd/mHK2tyV1u7pWnT6wm7xRoipxvOJhtcw/jWYNJpSE
pUrtOqkBP7vHGvYQE/1hMiQkEjKOwqU9ikxIXnMu8cy4qWo9NF5eR7K406GaAvg/
Qp6H2KyMAxNbqIH1bUexmEcC9/zN+O2NK1O5v3/z/y9E7SRQgqc=
=iDJk
-----END PGP SIGNATURE-----