bugGNU nano - Bugs: bug #63964, format string vulnerabilities for...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #63964: format string vulnerabilities for linter and custom rcfile

Submitter:  Vince Vince <vincevince>
Submitted:  Sun 26 Mar 2023 10:51:36 PM UTC
   
 
Severity:  4 - Important Status:  Fixed
Assigned to:  bens Open/Closed:  Closed

Thu 02 May 2024 05:33:12 AM UTC, comment #2: 

The fix was released in nano-8.0.  Thanks again for reporting.

 Benno Schulenberg <bens>
Group administrator
Mon 27 Mar 2023 10:18:59 AM UTC, comment #1: 

Thanks for reporting, and for the clear reproduction recipes!

The two issues should be fixed by commits b8ead3b5 and fdcafb83.

(I've not included your email address in the commit messages, to reduce the chances of you getting spam there.)

 Benno Schulenberg <bens>
Group administrator
Sun 26 Mar 2023 10:51:36 PM UTC, original submission:  

I want to report some format string security vulnerabilities in nano - the worst of which can cause potential arbitrary code execution when running the linter on a file.

To reproduce:

  • install nano and pyflakes (it also works with pylint) - I have verified this on nano version 7.2
  • use the attached nanorc and run nano test.py
  • start the linter with ESC b
  • it crashes, because of using user-supplied data from test.py through pyflakes as a printf() format string in statusline()


Expected behaviour:

  • no crash


There's also a smaller format string issue with limited security impact. It occurs when the rcfile has a command not understood error and the filename of the rcfile contains format string specifiers:

nano --rcfile /Users/vince/.nanorc%n%n%n%n%n

The attached patch should fix both issues.

Cheers
vince vince

Vince Vince <vincevince>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #54528:  test.py added by vincevince (183B - text/x-python-script)
file #54529:  nanorc.txt added by vincevince (60B - text/plain)
file #54530:  nanorc%n%n%n%n%n.txt added by vincevince (9B - text/plain)
file #54527:  nano.formatstringvulns.patch added by vincevince (1KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by vincevince (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-05-02 bens Open/ClosedOpen Closed
    2023-03-27 bens SummaryFormat string vulnerabilities in nano format string vulnerabilities for linter and custom rcfile
        Severity3 - Normal 4 - Important
        StatusNone Fixed
        Assigned toNone bens
    2023-03-26 vincevince Attached File- Added nano.formatstringvulns.patch, #54527
        Attached File- Added test.py, #54528
        Attached File- Added nanorc.txt, #54529
        Attached File- Added nanorc%n%n%n%n%n.txt, #54530

    Back to the top

    Copyright © 2025 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-04e1.
    Corresponding source code