DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:from:date:message-id:subject:to
	:content-type:content-transfer-encoding; q=dns; s=default; b=X1T
	ilkdL6XwJX+9SxZu3XOSYpcEvBnre6MTu9lYpW1IzDc/zNz90IjMKAcIXGIPWKnD
	FmB2vzVhYOOEptfhzzuYAdMMXlRYZ3clExQ4HoLk6KkS+L2gunvO7bXvCO5dWxje
	l8CRBsPs/XKo4GC+mEAV/4CPSG5wxJTuemZUxinw=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
From: houjingyi <houjingyi647@gmail.com>
Date: Tue, 5 Nov 2019 17:45:14 +0800
Message-ID: <CAN1eSkv02aZZb-09sYYwidexjZBNsPcMsEuit95P12r6vkccZw@mail.gmail.com>
Subject: report security problem
To: cygwin@cygwin.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit

fhandler_console::create_invisible_console_workaround in
newlib-cygwin\winsup\cygwin\fhandler_console.cc will call CreateProcessW to
create a new hidden process. According to CreateProcessW documention:

The lpApplicationName parameter can be NULL. In that case, the module name
must be the first white space–delimited token in the lpCommandLine string.
If you are using a long file name that contains a space, use quoted strings
to indicate where the file name ends and the arguments begin; otherwise,
the file name is ambiguous. For example, consider the string "c:\program
files\sub dir\program name". This string can be interpreted in a number of
ways. The system tries to interpret the possibilities in the following
order:
c:\program.exe
c:\program files\sub.exe
c:\program files\sub dir\program.exe
c:\program files\sub dir\program name.exe

Unfortunately fhandler_console::create_invisible_console_workaround did not
use quote. This problem can be triggered by many ways since
the component was used by other softwares. I can confirm it can at least be
triggered by git(https://git-scm.com/download/win). Just create program.exe
and put it to C:\problem.exe, git-bash.exe creates process mintty.exe,
mintty.exe loads msys-2.0.dll which contains the vulnerable code and
program.exe get executed(I will inform git too).

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple