Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5506

Re: RFC: proposed fix for CVE-2018-19518 in uw-imap

Show all headers | View raw

Hi Tomas,

Thanks for the feedback.

On Mon, Dec 24, 2018 at 08:47:55PM +0000, Tomas Bortoli wrote:
>    Hi Robert,
> 
>    Your patch seems not to be definitive against CVE-2018-19518.
>    This because checking for spaces won't be enough if an attacker uses some
>    "bash trick" to get a space...
>    In fact you can get a space by not typing it, with something like this:
> 
>      a=`date`;echo${a:3:1}asd
> 
>    Will print "asd".. it gets the space from a substring of "a".
> 

I tried numerous different such tricks and every one that I tried
between 'x' and '-o' in the host specification resulted in the
vulnerability not manifesting itself.

That said, I did not try this specific trick and I will investigte to
determine if it results in the vulnerability manifesting itself.

>    Regarding the code, there is a bit of redundancy as the "for" in the
>    if-else is repeated in both branches, it could be therefore placed after
>    the if-else and achieve the same semantic result without redundancy.
> 

There are two command templates involved in this section of code:
rshcommand and sshcommand.  The two for loops each operate on a
different command template.

>    About the bug, as far as I understand the injection is, eventually,
>    possible in the server name...shouldn't that be the "host" variable in the
>    patch? [1]
>    I am not sure...CVE description is quite smallish..
> 
Yes, the description could certainly use more detail.  That said, I did
include this in my original post:

    I also wondered whether it was possible to cause the vulnerability
    without a space in the hostname (somewhat related to the first
    question).  In any event, I concluded that the question of whether
    something is a valid hostname might be a bit complex to tackle and
    despite numerous attempts I was not able to exploit the
    vulnerability without the space between the host name and the
    command switch '-'.

I suppose it would be possible to apply the approach of counting tokens
to the host variable to ensure that it only contains a single token.
However, I do not think that is any better or worse than the approach I
came up with.

Regards,

-Roberto

-- 
Roberto C. Sánchez

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-23 04:30 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-24 22:50 +0100
    Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-26 09:50 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-25 12:30 +0100
    Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-28 05:30 +0100
      Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-28 15:30 +0100
      Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Tomas Bortoli <tomasbortoli@hotmail.it> - 2018-12-28 19:30 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Ola Lundqvist <ola@inguza.com> - 2018-12-28 21:50 +0100
  Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Roberto C. Sánchez <roberto@debian.org> - 2018-12-29 16:30 +0100
    RE: RFC: proposed fix for CVE-2018-19518 in uw-imap COSTEY Anthony <a.costey@caenlamer.fr> - 2018-12-29 17:10 +0100
    Re: RFC: proposed fix for CVE-2018-19518 in uw-imap Salvatore Bonaccorso <carnil@debian.org> - 2018-12-30 09:40 +0100
      Bug#914632: RFC: proposed fix for CVE-2018-19518 in uw-imap Magnus Holmgren <holmgren@debian.org> - 2019-02-24 20:40 +0100

csiph-web