touch-packages team mailing list archive

[Rolf Leggewie <1091473@xxxxxxxxxxxxxxxxxx>]

lucid has seen the end of its life and is no longer receiving any
updates. Marking the lucid task for this ticket as "Won't Fix".

** Changed in: grep (Ubuntu Lucid)
       Status: Triaged => Won't Fix

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to grep in Ubuntu.
https://bugs.launchpad.net/bugs/1091473

Title:
  grep <2.11 is vulnerable to "Arbitrary command execution"

Status in grep package in Ubuntu:
  Fix Released
Status in grep source package in Lucid:
  Won't Fix
Status in grep source package in Oneiric:
  Won't Fix
Status in grep source package in Precise:
  Triaged
Status in grep source package in Quantal:
  Fix Released
Status in grep source package in Raring:
  Fix Released
Status in grep source package in Hardy:
  Won't Fix

Bug description:
  grep <2.11 is vulnerable to command execution vulnerability, and it is
  not possible to patch unless you build the source directly from the
  git repo.

  ubuntu 12.04(And everything else, I would assume) uses version 2.10 of
  grep. it is not possible to upgrade without downloading the src and
  building it yourself.


  
  PoC:

  perl -e 'print "x"x(2**31)' | grep x > /dev/null

  This is the grep news form for this:

   * Noteworthy changes in release 2.11 (2012-03-02) [stable]

    ** Bug fixes

      grep no longer dumps core on lines whose lengths do not fit in 'int'.
      (e.g., lines longer than 2 GiB on a typical 64-bit host).
      Instead, grep either works as expected, or reports an error.
      An error can occur if not enough main memory is available, or if the
      GNU C library's regular expression functions cannot handle such long lines.
      [bug present since "the beginning"]


  Solution: Send out a grep update with atleast 2.11 grep from
  http://git.sv.gnu.org/cgit/grep.git


  Full PoC of actually "abusing" this vulnerablility(ls -la within grep)
  can be provided, if 100% needed.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grep/+bug/1091473/+subscriptions