Mondays, gotta love’m.
Many Linux distributions ship with the ‘less’ command automagically
interfaced to ‘lesspipe’-type scripts, usually invoked via LESSOPEN.
This is certainly the case for CentOS and Ubuntu.
Unfortunately, many of these scripts appear to call a rather large
number of third-party tools that likely have not been designed with
malicious inputs in mind. On CentOS, lesspipe appears to include
things such as groff + troff + grotty, man, and cpio.
…
…where we end up allocating a zero-byte buffer and then promptly
writing out of bounds (just under the buffer on 32-bit systems or
somewhere above it on 64-bit).
Michal Zalewski, seclist.org
Buffer overflow, anyone? I wonder what the real-world impact of this is. I don’t use less at all (I’m a more user), neither at the CLI nor in scripts. But how can I be certain other scripts, like vendor-supplied ones, aren’t using this and potentially making me vulnerable? Unsetting the LESSOPEN and LESSCLOSE environment variables seems like they might actually break more than they fix.
Some more reading material can be found on the seclist.org post and on the HackerNews post.