bugfindutils - Bugs: bug #17478, in `-ls` mode, filenames not...


bug #17478: in `-ls` mode, filenames not escaped in error messages

Submitter:  Tavis Ormandy <taviso>
Submitted:  Sat 19 Aug 2006 07:38:54 PM UTC
Category:  find Severity:  3 - Normal
Item Group:  Wrong result Status:  Fixed
Privacy:  Public Assigned to:  jay
Originator Name:  Open/Closed:  Closed
Release:  4.2.28 Fixed Release:  4.3.5
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:


Sun 29 Apr 2007 03:53:53 PM UTC, comment #2: 

This bug is fixed in the current CVS code for findutils-4.3.x.

James Youngman <jay>
Project Administrator
Tue 07 Nov 2006 06:18:55 PM UTC, comment #1: 

I guess I have managed to submit a duplicate of this bug in  #18203. - Find 4.2.x does not escape stuff in errormessages (no matter whether -ls or -print was specified as action.)

cu andreas

Andreas Metzler <ametzler>
Sat 19 Aug 2006 07:38:54 PM UTC, original submission:  

The `UNUSUAL FILENAMES` section of the find man page indicates that the actions `-ls`, `-fls`, etc. will safely sanitise filenames for display on a terminal, however error messages are still unsaitised.

A malicious user who wanted to hide the location of a directory heirarchy from an administrator could theoretically abuse this flaw to send the terminal control characters to modify the output of find.


$ mkdir test
$ for ((i=0;i<1024;i++)); do touch `printf "\a%d" $i`; done
$ rm * & find -ls
4056900    0 -rw-r--r--   1 taviso   users           0 Aug 19 21:36 ./999\007\007
find: ./1000: No such file or directory
find: ./1001: No such file or directory
find: ./1002: No such file or directory

(ie, the error messages contain \a)

Tavis Ormandy <taviso>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by jay (Posted a comment)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.





    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-05-05 jay Assigned toNone jay
        Open/ClosedOpen Closed
        Fixed ReleaseNone 4.3.5
    2007-04-29 jay StatusNone Fixed

    Back to the top

    Powered by Savane 3.9