Re: [Bluez-devel] Possible security vulnerability in hcid when calling pin helper

["Henryk Plötz" <henryk@ploetzli.ch>]

[-- Attachment #1.1: Type: text/plain, Size: 781 bytes --]

Moin,

Am Fri, 05 Aug 2005 05:16:34 +0200 schrieb Marcel Holtmann:

> thanks for catching this problem. Do you have a fix for it?

Now I have, I think. Doing string escaping in C is really awkward, but
this patch should prefix all occurences of ", \, $ or ` in the name with
an \, and will also change the enclosing single quotes to double quotes
(because no escaping is possible in single quotes). There would also be
an alternative way to fix it: remove the popen() and instead do a
pipe()/fork()/dup2()/execv() combination. That should be more clean, but
likely more complicated.

-- 
Henryk Plötz
Grüße aus Berlin
~~~~~~~ Un-CDs, nein danke! http://www.heise.de/ct/cd-register/ ~~~~~~~
~ Help Microsoft fight software piracy: Give Linux to a friend today! ~

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1.2: callpinhelper.patch --]
[-- Type: text/x-patch; name="callpinhelper.patch", Size: 1249 bytes --]

--- security.c.orig	2005-08-05 05:34:15.000000000 +0200
+++ security.c	2005-08-05 06:18:14.000000000 +0200
@@ -306,7 +306,7 @@ static void call_pin_helper(int dev, bda
 {
 	pin_code_reply_cp pr;
 	struct sigaction sa;
-	char addr[18], str[255], *pin, name[249];
+	char addr[18], str[255], *pin, name[249], escapename[498];
 	FILE *pipe;
 	int ret, len;
 
@@ -331,9 +331,28 @@ static void call_pin_helper(int dev, bda
 	read_device_name(sba, &ci->bdaddr, name);
 	//hci_remote_name(dev, &ci->bdaddr, sizeof(name), name, 0);
 
+	/* Escape special chars from the remote name */
+	{
+		char *src = name, *dest = escapename, 
+		    *end = name + sizeof(name) - 1;
+		while (src < end && *src != 0) {
+			switch(*src) {
+				case '\"': /* fall-through */
+				case '$':
+				case '`':
+				case '\\': 
+					*dest++ = '\\';
+				default:
+					*dest++ = *src++;
+	    		}
+		}
+		*dest = 0;
+	}
+
 	ba2str(&ci->bdaddr, addr);
-	snprintf(str, sizeof(str), "%s %s %s \'%s\'", hcid.pin_helper,
-					ci->out ? "out" : "in", addr, name);
+	snprintf(str, sizeof(str), "%s %s %s \"%s\"", hcid.pin_helper,
+					ci->out ? "out" : "in", addr, 
+					escapename);
 
 	setenv("PATH", "/bin:/usr/bin:/usr/local/bin", 1);
 

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]