Anonymous
(credit to fehlix for pointing this out)
.
.
THE PATCHED gksu IS STILL VULNERABLE TO SURREPTITIOUS EXECUTION OF ARBITRARY COMMANDS WITHIN NESTED SUBSHELLS.
THE SCOPE OF THIS VULNERABIITY IS EVEN BROADER THAN THE CASE CITED BY CVE-2014-2886.
THIS VULNERABILITY AFFECTS BOTH “su-mode” AND “sudo-mode” USAGE.
a demonstration of the problem:
Issue either of these commands from terminal emulator commandline and note the result
gksu --su-mode echo "hello$(touch /tmp/boom)"
or
gksu --sudo-mode echo "hello$(touch /tmp/boom)"
THE AUTH DIALOG (MISLEADINGLY) DISPLAYS
the application ‘echo hello‘ lets you modify essential parts of your system
AND
regardless of OK // CANCEL choice…
the file /tmp/boom IS SUCCESSFULLY CREATED
==========================================================
==========================================================
==========================================================
Now, before further modifiyng the parsing to guard against embedded $( substrings,
we must investigate whether other characters (backticks? control characters? escape sequences?) could be to used initiate a nested subshell.