Ruby/Gnome2 0.16.0 Format String Vulnerability

Advisory Text :

RubyGnome2 0.16.0

Format String Vulnerability In Gtk::MessageDialog

http://em386.blogspot.com

Ruby Gnome2 is a project to provide GTK2 bindings to ruby scripts so you
can write GUI code in less time. There is a format string vulnerability in
Gtk::MessageDialog(). This design flaw does not

allow for a user generated string to be safely sent to this function.

It is really just an API to the GTK2 function gtk_message_dialog_new()
Ruby/Gnome2 does not properly use a format specifier for the message

variable in ruby-gnome2-all-0.16.0/gtk/src/rbgtkmessagedialog.c as
requested by the Gtk man page for this function.

...

w = gtk_message_dialog_new(NIL_P(parent) ? NULL :
GTK_WINDOW(RVAL2GOBJ(parent)),

RVAL2GFLAGS(flags, GTK_TYPE_DIALOG_FLAGS),

RVAL2GENUM(type, GTK_TYPE_MESSAGE_TYPE),

RVAL2GENUM(buttons, GTK_TYPE_BUTTONS_TYPE),

(const gchar*)(NIL_P(message) ? "": RVAL2CSTR(message)));

...

The GTK2 documentation:

http://www.gtk.org/api/2.6/gtk/GtkMessageDialog.html#gtk-message-dialog-
new

states that message should be a 'printf style format string' and after that
should be arguments to message. However calling messagedialog from your
ruby script does not support this.

The vulnerability can be exploited by sending a specially crafted string to
the function. An example ruby program is provided as a POC.

...

#!/usr/bin/env ruby

# ruby rubber.rb %x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x

require 'libglade2'

my_string = ARGV[0]

dialog = Gtk::MessageDialog.new(@main_app_window, Gtk::Dialog::MODAL,

Gtk::MessageDialog::INFO,

Gtk::MessageDialog::BUTTONS_CLOSE,

"%s - Was your string!" % my_string)

dialog.run

dialog.destroy

...

A temporary work around for this vulnerability is using the markup member:

dialog.markup = "#{my_string} - Was your string!"

Or

my_string = "my_string = my_string.gsub(/%/, "%%")

I have found a few ruby/gnome2 apps out there who use the API in this
unsafe manner.

Fixed Nov 27th 2007 in Ruby/Gnome2 SVN

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Ruby/Gnome2 0.16.0 Format String Vulnerability