bugfindutils - Bugs: bug #17478, in `-ls` mode, filenames not...

 
 

bug #17478: in `-ls` mode, filenames not escaped in error messages

Submitted by:  Tavis Ormandy <taviso>
Submitted on:  Sat 19 Aug 2006 07:38:54 PM UTC  
 
Category: findSeverity: 3 - Normal
Item Group: Wrong resultStatus: Fixed
Privacy: PublicAssigned to: James Youngman <jay>
Originator Name: Open/Closed: Closed
Release: 4.2.28Fixed Release: 4.3.5

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 29 Apr 2007 03:53:53 PM UTC, comment #2:

This bug is fixed in the current CVS code for findutils-4.3.x.

James Youngman <jay>
Project AdministratorIn charge of this item.
Tue 07 Nov 2006 06:18:55 PM UTC, comment #1:

I guess I have managed to submit a duplicate of this bug in #18203. - Find 4.2.x does not escape stuff in errormessages (no matter whether -ls or -print was specified as action.)

cu andreas

Andreas Metzler <ametzler>
Sat 19 Aug 2006 07:38:54 PM UTC, original submission:

The `UNUSUAL FILENAMES` section of the find man page indicates that the actions `-ls`, `-fls`, etc. will safely sanitise filenames for display on a terminal, however error messages are still unsaitised.

A malicious user who wanted to hide the location of a directory heirarchy from an administrator could theoretically abuse this flaw to send the terminal control characters to modify the output of find.

Reproduce:

$ mkdir test
$ for ((i=0;i<1024;i++)); do touch `printf "\a%d" $i`; done
$ rm * & find -ls
...
4056900 0 -rw-r--r-- 1 taviso users 0 Aug 19 21:36 ./999\007\007
find: ./1000: No such file or directory
find: ./1001: No such file or directory
find: ./1002: No such file or directory

(ie, the error messages contain \a)

Tavis Ormandy <taviso>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jay (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 05 May 2007 01:24:10 PM UTCjayAssigned toNone=>jay
      Open/ClosedOpen=>Closed
      Fixed ReleaseNone=>4.3.5
    Sun 29 Apr 2007 03:53:53 PM UTCjayStatusNone=>Fixed

    Back to the top


    Powered by Savane 3.1-cleanup1