Subject: bug#59544: closed (Re: bug#59544: [PATCH] Fixed lib-src/etags.c command execute vulnerability)

From: [email-masked] (GNU bug Tracking System)
Date: Sun, 27 Nov 2022 18:08:02 +0000

Your bug report

#59544: [PATCH] Fixed lib-src/etags.c command execute vulnerability

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
59544: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=59544
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#59544: [PATCH] Fixed lib-src/etags.c command execute vulnerability
From: Eli Zaretskii <[email-masked]>
To: lux <[email-masked]>
Cc: [email-masked], [email-masked]
Date: Sun, 27 Nov 2022 20:07:54 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

> Date: Sun, 27 Nov 2022 23:44:07 +0800
> From: lux <[email-masked]>
> 
> On Sun, 27 Nov 2022 16:15:38 +0200
> Eli Zaretskii <[email-masked]> wrote:
> 
> > But something is wrong with the 2 new tests: they fail.  I replaced
> > the "good" files with the ones I get on my system, but the test fails
> > on another system.  Could you please look into the test failures and
> > find a fix?
> 
> Hi, I think because the order of the tag data of the files generated by
> different OS environments is different.
> 
> I sorted the file using the sort command, test ok.
> 
> ctags_update: CTAGS.good_update ${infiles}
> 	head -n 100 CTAGS.good_update > CTAGS
> 	tail -n 100 CTAGS.good_update >> CTAGS
> 	${RUN} ${CTAGS_PROG} -o CTAGS -u ${ARGS}
> 	diff -u --suppress-common-lines --width=80 <(sort
> CTAGS.good_update) <(sort CTAGS)
> 
> 	cp crlf CTAGS
> 	${RUN} ${CTAGS_PROG} -o CTAGS -u ${ARGS}
> 	diff -u --suppress-common-lines --width=80 <(sort
> 	CTAGS.good_crlf) <(sort CTAGS)

Thanks, I installed a variant of this using more portable commands.

And with that, I'm closing this bug.

Subject: [PATCH] Fixed lib-src/etags.c command execute vulnerability
From: "lux" <[email-masked]>
To: "bug-gnu-emacs" <[email-masked]>
Cc: lux <[email-masked]>
Date: Thu, 24 Nov 2022 23:27:13 +0800
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi, In ctags (Emacs <= 28.2.50) has a command execute vulnerability.

When using the -u parameter, ctags will execute external shell commands by calling the system() function, if there are special file names, unexpected shell commands may be executed. The example is as follows:

$ ls
etags.c

$ /usr/local/bin/ctags *.c
$ touch "'| uname -a #.c"
$ /usr/local/bin/ctags -u *.c
Linux mypc 6.0.8-300.fc37.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Nov 11 15:09:04 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

^C/usr/local/bin/ctags: failed to execute shell command

The vulnerability occurs in the following code:

char *z = stpcpy (cmd, "mv ");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
z = stpcpy (z, tagfile);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
z = stpcpy (z, " OTAGS;grep -Fv '\t");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
z = stpcpy (z, argbuffer[i].what);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
z = stpcpy (z, "\t' OTAGS &gt;");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
z = stpcpy (z, tagfile);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
strcpy (z, ";rm OTAGS");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
if (system (cmd) != EXIT_SUCCESS)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
&nbsp; fatal ("failed to execute shell command");&nbsp; &nbsp; &nbsp;

Because the file name is not checked, the file name is used as a concatenated string:

mv tags OTAGS;grep -Fv '	'| uname -a #.c	' OTAGS &gt;tags;rm OTAGS

Email attachments are patches.