REDHAT-BUG-625893

First published: Fri Aug 20 2010(Updated: )

Harald van Dijk discovered [1],[2] that glibc's locale command does not sufficiently sanitize the user environment. According to POSIX specifications [3], the output of the 'locale' command must be appropriately quoted and safe to execute, in order to restore the locale after temporarily forcing a change (such as LC_ALL=C). However, this is not the case with glibc versions up to and including 2.12.1: LANG=' rm -rf /' locale locale: Cannot set LC_CTYPE to default locale: No such file or directory locale: Cannot set LC_MESSAGES to default locale: No such file or directory locale: Cannot set LC_ALL to default locale: No such file or directory LANG= rm -rf / LC_CTYPE=" rm -rf /" LC_NUMERIC=" rm -rf /" LC_TIME=" rm -rf /" LC_COLLATE=" rm -rf /" LC_MONETARY=" rm -rf /" LC_MESSAGES=" rm -rf /" LC_PAPER=" rm -rf /" LC_NAME=" rm -rf /" LC_ADDRESS=" rm -rf /" LC_TELEPHONE=" rm -rf /" LC_MEASUREMENT=" rm -rf /" LC_IDENTIFICATION=" rm -rf /" LC_ALL= Any script that does "eval $(locale)" or something similar will execute the unquoted commands. The POSIX specification states: "The &lt;value&gt; and &lt;implied value&gt; shown above shall be properly quoted for possible later reentry to the shell. The &lt;value&gt; shall not be quoted using double-quotes (so that it can be distinguished by the user from the &lt;implied value&gt; case, which always requires double-quotes)." This has been corrected upstream [4]. [1] <a href="http://bugs.gentoo.org/show_bug.cgi?id=330923">http://bugs.gentoo.org/show_bug.cgi?id=330923</a> [2] <a href="http://sources.redhat.com/bugzilla/show_bug.cgi?id=11904">http://sources.redhat.com/bugzilla/show_bug.cgi?id=11904</a> [3] <a href="http://www.opengroup.org/onlinepubs/000095399/utilities/locale.html">http://www.opengroup.org/onlinepubs/000095399/utilities/locale.html</a> [4] <a href="http://sourceware.org/git/?p=glibc.git;a=patch;h=026373745eab50a683536d950cb7e17dc98c4259">http://sourceware.org/git/?p=glibc.git;a=patch;h=026373745eab50a683536d950cb7e17dc98c4259</a>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/references
• agent/type
• agent/first-publish-date
• agent/last-modified-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2011-1095
• agent/severity
• agent/description
• agent/event
• agent/trending
• agent/source
• agent/softwarecombine
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/gnu
• canonical/gnu c library (glibc)