X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:cc:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=hJBj59RokuPpVbzfULoZBkHXR/DhlfpoPR8dgNs9XzmMHSFj94PAp
	8ANzXtdtsyMhWdDrGmOmKs1s6Wg0ybPTcnzpjILnyZTgeB2G9ScKOQZ/OxfhTf4w
	Pguot3DiWuGrnL1euF61M0fGa1ajoql2ETIAVJuh+DINEMueetUDzM=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:cc:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	bh=WmF6DzPHS3QmrX1d4xgowT7bHbI=; b=OzziylVPE7nsyL0akS7E2VOLhQpy
	bQXlgdcN5GQFZhit3pa5zAF8J5qHuaRgNHTJ9IUtNqtO0fHBdR9C45AykAcrGwXm
	dqq5oRunCMDeFy9PlxejrZoydL/0U8T0P3v47fYoBmshGwEfe58ba7hEif0FlSXj
	n5Vt1O+OA9naDFI=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Spam-SWARE-Status:	No, score=-104.3 required=5.0 tests=AWL,BAYES_00,GOOD_FROM_CORINNA_CYGWIN,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 spammy=H*F:D*cygwin.com
X-HELO:	mout.kundenserver.de
Date:	Tue, 5 Nov 2019 12:17:39 +0100
From:	Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To:	houjingyi <houjingyi647 AT gmail DOT com>
Cc:	cygwin AT cygwin DOT com
Subject:	Re: report security problem
Message-ID:	<20191105111739.GN3372@calimero.vinschen.de>
Reply-To:	cygwin AT cygwin DOT com
Mail-Followup-To:	houjingyi <houjingyi647 AT gmail DOT com>, cygwin AT cygwin DOT com
References:	<CAN1eSkv02aZZb-09sYYwidexjZBNsPcMsEuit95P12r6vkccZw AT mail DOT gmail DOT com>
MIME-Version:	1.0
In-Reply-To:	<CAN1eSkv02aZZb-09sYYwidexjZBNsPcMsEuit95P12r6vkccZw@mail.gmail.com>
User-Agent:	Mutt/1.12.1 (2019-06-15)

--+Hr//EUsa8//ouuB
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Nov  5 17:45, houjingyi wrote:
> fhandler_console::create_invisible_console_workaround in
> newlib-cygwin\winsup\cygwin\fhandler_console.cc will call CreateProcessW =
to
> create a new hidden process. According to CreateProcessW documention:
>=20
> The lpApplicationName parameter can be NULL. In that case, the module name
> must be the first white space=E2=80=93delimited token in the lpCommandLin=
e string.
> If you are using a long file name that contains a space, use quoted strin=
gs
> to indicate where the file name ends and the arguments begin; otherwise,
> the file name is ambiguous. For example, consider the string "c:\program
> files\sub dir\program name". This string can be interpreted in a number of
> ways. The system tries to interpret the possibilities in the following
> order:
> c:\program.exe
> c:\program files\sub.exe
> c:\program files\sub dir\program.exe
> c:\program files\sub dir\program name.exe
>=20
> Unfortunately fhandler_console::create_invisible_console_workaround did n=
ot
> use quote. This problem can be triggered by many ways since
> the component was used by other softwares. I can confirm it can at least =
be
> triggered by git(https://git-scm.com/download/win). Just create program.e=
xe
> and put it to C:\problem.exe, git-bash.exe creates process mintty.exe,
> mintty.exe loads msys-2.0.dll which contains the vulnerable code and
> program.exe get executed(I will inform git too).

Thanks for the report.  I pushed a patch

  https://sourceware.org/git/?p=3Dnewlib-cygwin.git;a=3Dcommitdiff;h=3D530b=
866c8e47

and created new developer snapshots.  Please give the today's
snapshot from https://cygwin.com/snapshots/ a try.


Thanks,
Corinna

--=20
Corinna Vinschen
Cygwin Maintainer

--+Hr//EUsa8//ouuB
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEoVYPmneWZnwT6kwF9TYGna5ET6AFAl3BWlMACgkQ9TYGna5E
T6AIDA//eXGOtXrgF4DJTF0fxbNwcxKfltCk/nUsYdsIIuOE7IL98Q5LfXnCrowA
MOhR6mWtQHd04Pn3c6/cHauQMJ4Rob0V944U1FLk7/xY6aPta1rAmo8jsoCmHu4T
DGMr8b50hEQoaM+Tc8GKNWPaxe31UsI1kssJ/XtM3JihGoN9R4cUJ2Bre88SncuU
IAnhtfVQZcDy06kW0qwUe6XMnCdF2latbJxSzJjtwOPHQSRy67UI8kL7yHoYvCGk
dwikcPnYBXeKWrO9NHnUoAK5XdiN1cNwMOYko4PsNu/wEloDkzNnrXXUmTEut1CR
nPOs17ilyFGjkw+/ASimUQGvu1Fm6GaZbD3TpmzbjRtKj6CKDwK9AzeQUvBfT3rI
HUhw0ngOR/WwiIMj0Q4gHby7TqXGMwUgYw5wTTrhcKfzC/neJgmZHa1bRne8BnY6
tcoVTsCh2sy1hx7Y+jKj5rfQ2erjf623A8+VZfT+I99bi5tVtd4E5wzcSO7+AY18
lmTi/K4vCg3BmakrpvFdw04uMPP4xpvvXVLMpgRsAXhqN3h7knPnsBOc5IpZHCg/
RQUIeCQT2RwgR8k87mSX2E7HhVXkSHWVTVq9SMJ4AR5I/jwZqAa+s7b9lMQ64wzu
Lipi9wAbZoEpleITeVsmBRtI8cBMAarl1SYB9Sphd5Qh8yNClUA=
=KTcB
-----END PGP SIGNATURE-----

--+Hr//EUsa8//ouuB--

- Raw text -