2017-08-07
release: 1.2.4
Index: trunk/doc/security/bug1.html
===================================================================
--- trunk/doc/security/bug1.html (nonexistent)
+++ trunk/doc/security/bug1.html (revision 11599)
@@ -0,0 +1,69 @@
+
+
+
+ pcb-rnd - news
+
+
+
+
+
+ pcb-rnd security related bug #1: execbug
+
+Users opening untrusted boards or projects may unintentionally execute
+external programs.
+
+ 1. Bug description
+
+pcb-rnd inherited 5 settings from gEDA/PCB that let pcb-rnd (and PCB)
+execute external processes, wrapping certain file operations:
+
+ - conf_core.rc.save_command
+
- conf_core.rc.rat_command
+
- conf_core.rc.library_shell
+
- conf_core.rc.file_command
+
- conf_core.rc.font_command
+
+
+The old Settings system has been replaced in pcb-rnd; the new conf system
+allows any configuration setting to be specified in a project file or a
+board file. This includes the above 5 items as well.
+
+An attacker may produce a project or a single board file in .pcb or .lht format
+that contains the above config settings, executing arbitrary code on the
+user's computer when pcb-rnd opens or saves the file or loads fonts or
+footprints or netlists.
+
+ 2. How to prevent the attack
+
+ 2.1. By using a version that is not affected
+
+
+ - from svn /trunk, any revision newer than r11597
+
- last stable release, patched: 1.2.5b
+
- old stable release, patched: 1.1.4b
+
+
+ 2.2. By manually checking board and project files from untrusted source
+
+Before opening the file, grep for _command and _shell in it, remove
+the offending lines.
+
+
+ 3. What did the patch/fix do
+
+The patch prevents these 5 settings to take effect when the source of
+the setting is not from one of these:
+
+ - internal (embedded in the executable, used as the ultimate fallback when no config is available)
+
- system installed config file (typically under /usr/)
+
- user config file (typically in ~/.pcb-rnd/)
+
- command line argument (-c)
+
+
+This bans sources like the board file, the project file and environmental
+variable.
+
+
+
+
+
|