[ minicom-Bugs-300083 ] threatening: shell expansion done for filenames

Sat, 27 Sep 2003 20:45:19 +0200

Bugs item #300083, was opened at 2003-08-12 22:16
You can respond by visiting: 
http://alioth.debian.org/tracker/?func=detail&atid=100031&aid=300083&group_id=31

Category: None
Group: None
>Status: Closed
Resolution: None
Priority: 5
Submitted By: Ivan Zakharyaschev (imz-guest)
Assigned to: Nobody (None)
Summary: threatening: shell expansion done for filenames

Initial Comment:
As evidenced by the following example, filenames of the
files sent via Zmodem are subject to shell expansion --
that's dangerous for the rest of the system since a
minicom user can unintentionally peform a very bad
action by sending a file with a special name. A normal
user would expect that a filename selected from a list
would not be expanded.

Example:

...running bash...

$ echo a > a\
$ minicom

Ctrl-A S, select zmodem, then select the file from the
list with some special name, e.g., a`wall hi`, Enter

As the result, "wall hi" is executed.

Originally reported by Pilot at
http://bugs.altlinux.ru/view_bug_advanced_page.php?f_id=0002772
(in Russian).

----------------------------------------------------------------------

>Comment By: Adam Lackorzynski (al-guest)
Date: 2003-09-27 20:45

Message:
Logged In: YES 
user_id=104

Should be fixed in CVS (I actually removed the features
which feeds the command through a shell, I don't see
any use for that right now).

----------------------------------------------------------------------

Comment By: Ivan Zakharyaschev (imz-guest)
Date: 2003-08-12 22:55

Message:
Logged In: YES 
user_id=2860

The report concerns minicom 2.1 and 2.00.0 on GNU/Linux.

--
Ivan Zakharyaschev
ALT Linux Team member
I'm a Sisyphus developer: it's core is GNU/Linux
http://www.altlinux.ru, http://www.altlinux.com

----------------------------------------------------------------------

You can respond by visiting: 
http://alioth.debian.org/tracker/?func=detail&atid=100031&aid=300083&group_id=31