Re: [Pkg-dia-team] Bug#330890: dia: Arbitrary code execution when importing a .svg file
tag 330890 security
tag 330890 upstream
forwarded 330890 http://bugzilla.gnome.org/show_bug.cgi?id=317637
# woody:
notfound 330890 0.88.1-3
# sarge:
found 330890 0.94.0-7
# testing/unstable:
found 330890 0.94.0-14
# experimental
found 330890 0.94.0+CVS20050917-2
thanks
Hi,
thanks for reporting this issue.
Joxean Koret wrote:
> The script diasvg_import.py that comes with the current Debian stable
> version of Dia is vulnerable to an arbitrary code execution.
>
> I tried to contact with the Dia team too many times but without any look
> so, I think, there is no patch at the moment for the issues.
I couldn't find your comment on the upstream mailing list or in a GNOME
mozilla bug.
> Attached goes a working exploit to test the vulnerability.
Attached goes a fix that directly applies to the stable, testing and
unstable versions of dia in Debian (the respective code doesn't appear
in woody). Tested. Will coordinate with debian-security before uploading
to make fixes to stable and unstable consistent.
bye,
Roland
Index: plug-ins/python/diasvg_import.py
===================================================================
--- plug-ins/python/diasvg_import.py (revision 7)
+++ plug-ins/python/diasvg_import.py (working copy)
@@ -54,6 +54,10 @@
return (int(m.group(1)) / 255.0, int(m.group(2)) / 255.0, int(m.group(2)) / 255.0)
# any more ugly color definitions not compatible with pango_color_parse() ?
return string.strip(s)
+
+def eval_secure(s):
+ return string.translate(s, string.maketrans("\"()", "___"))
+
class Object :
def __init__(self) :
self.props = {"x" : 0, "y" : 0, "stroke" : "none"}
@@ -65,7 +69,8 @@
sp2 = string.split(string.strip(s1), ":")
if len(sp2) == 2 :
try :
- eval("self." + string.replace(sp2[0], "-", "_") + "(\"" + string.strip(sp2[1]) + "\")")
+ eval("self." + eval_secure(string.replace(sp2[0], "-", "_")) +
+ "(\"" + eval_secure(string.strip(sp2[1])) + "\")")
except AttributeError :
self.props[sp2[0]] = string.strip(sp2[1])
def x(self, s) :
@@ -282,7 +287,7 @@
def CopyProps(self, dest) :
# to be used to inherit group props to childs _before_ they get their own
for p in self.props.keys() :
- sf = "dest." + string.replace(p, "-", "_") + "(\"" + str(self.props[p]) + "\")"
+ sf = "dest." + eval_secure(string.replace(p, "-", "_")) + "(\"" + eval_secure(str(self.props[p])) + "\")"
try : # accessor first
eval(sf)
except :
@@ -561,7 +566,7 @@
o = Group()
stack.append(o)
else :
- s = string.capitalize(name) + "()"
+ s = eval_secure(string.capitalize(name)) + "()"
try :
o = eval(s)
except :
@@ -575,7 +580,7 @@
ma = string.replace(a, "-", "_")
# e.g. xlink:href -> xlink__href
ma = string.replace(ma, ":", "__")
- s = "o." + ma + "(\"" + attrs[a] + "\")"
+ s = "o." + eval_secure(ma) + "(\"" + eval_secure(attrs[a]) + "\")"
try :
eval(s)
except AttributeError, msg :
Reply to: