From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 32281 invoked by alias); 5 Nov 2019 09:45:44 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 32095 invoked by uid 89); 5 Nov 2019 09:45:29 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=0.1 required=5.0 tests=AWL,BAYES_00,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=no version=3.3.1 spammy=HX-HELO:sk:mail-il, HX-Languages-Length:2705, H*c:alternative X-HELO: mail-il1-f178.google.com Received: from mail-il1-f178.google.com (HELO mail-il1-f178.google.com) (209.85.166.178) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Tue, 05 Nov 2019 09:45:28 +0000 Received: by mail-il1-f178.google.com with SMTP id m16so17576018iln.13 for ; Tue, 05 Nov 2019 01:45:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=3NyjaJ6FFZJtCRCw/01HxzhWED0Ey1rvT9w5hXO2GzA=; b=SnbHpD8QvJKomjv9LZ4QSavu1iBkac182RlIZuxeVCMxQ40D/kj0Y53ln5fUGg4Vjp kLYkccF4EmbgQAlJ5tZffUE4CSu1PDXOpo4I1J3XIgi7JO2cAapoP7EFP/1/nahxYfx3 IU1r2SRyRsmpwNoK+yT0ayriXr7lwzomq1/yucSEZPvU+ofvdUtvIiJNzcycOzpcRw0w GhXLu8zf+7FMPdjz1JAs8OaG4FZGObHNu2yLfk7xCQhiWDwTrPQYZ59EOujQ3utyeE/v +pva9YEhy/E2IdECQyUnHWQRWWvNDi5ixtjGaTXWt1WEA3XuOUxxhTszYTNwb9o7cPiJ 9yBQ== MIME-Version: 1.0 From: houjingyi Date: Tue, 05 Nov 2019 09:45:00 -0000 Message-ID: Subject: report security problem To: cygwin@cygwin.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-IsSubscribed: yes X-SW-Source: 2019-11/txt/msg00018.txt.bz2 fhandler_console::create_invisible_console_workaround in newlib-cygwin\winsup\cygwin\fhandler_console.cc will call CreateProcessW to create a new hidden process. According to CreateProcessW documention: The lpApplicationName parameter can be NULL. In that case, the module name must be the first white space=E2=80=93delimited token in the lpCommandLine = string. If you are using a long file name that contains a space, use quoted strings to indicate where the file name ends and the arguments begin; otherwise, the file name is ambiguous. For example, consider the string "c:\program files\sub dir\program name". This string can be interpreted in a number of ways. The system tries to interpret the possibilities in the following order: c:\program.exe c:\program files\sub.exe c:\program files\sub dir\program.exe c:\program files\sub dir\program name.exe Unfortunately fhandler_console::create_invisible_console_workaround did not use quote. This problem can be triggered by many ways since the component was used by other softwares. I can confirm it can at least be triggered by git(https://git-scm.com/download/win). Just create program.exe and put it to C:\problem.exe, git-bash.exe creates process mintty.exe, mintty.exe loads msys-2.0.dll which contains the vulnerable code and program.exe get executed(I will inform git too). -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple