804067 - SeaMonkey Installer can run untrusted program

Status: RESOLVED FIXED

(SeaMonkey :: Installer, defect)

Description

[Frank Wein [:mcsmurf]]

See Bug 770478, the installer should quote the string around the path to actually launch SeaMonkey and not something else.

Comment 1

[Frank Wein [:mcsmurf]]

Attachment: Patch

Easy to review, fixes a small security issue (the launched app runs as app with normal user privs, not with escalated admin privs).

Comment 2

[Frank Wein [:mcsmurf]]

Comment on attachment 673780 [details] [diff] [review]
Patch

[Approval Request Comment]
Regression caused by (bug #): -
User impact if declined: Small security risk for users
Testing completed (on m-c, etc.): Patch has been tested locally and it fixes the bug: Without the patch the installer launches the program C:\program.exe (as an example), with the patch the installer launches SeaMonkey
Risk to taking this patch (and alternatives if risky): Very low risk, the patch just quotes a string before handing it over to another routine
String changes made by this patch: none

Comment 3

[Justin Wood (:Callek)]

Comment on attachment 673780 [details] [diff] [review]
Patch

Review of attachment 673780 [details] [diff] [review]:
-----------------------------------------------------------------

I'm about to land to beta, but please also land on our comm-release tree, we're spinning a 2.13.2 (if for no other reason than our Addressbook failure, and I see no reason this fix shouldn't ride along)

Comment 4

[Justin Wood (:Callek)]

Dan/Al,

This is a heads up that SeaMonkey is taking this sec-bug in SeaMonkey 2.13.2 [to coincide with Firefox/TB 16.0.2 release]

This particular bug corresponds with http://www.mozilla.org/security/announce/2012/mfsa2012-67.html which is already publically announced, just something that we missed along the way. I will *make sure* it is in our release, even though its not landed yet.

Comment 5

[Justin Wood (:Callek)]

Landed straight to beta: http://hg.mozilla.org/releases/comm-beta/rev/33330479abf8

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to Justin Wood (:Callek) from comment #3)
> we're spinning a 2.13.2 (if for no other reason than our Addressbook
> failure, and I see no reason this fix shouldn't ride along)

You're also including the Location bug fixes bholley is landing, I hope?

Comment 7

[Frank Wein [:mcsmurf]]

Pushed to comm-central: http://hg.mozilla.org/comm-central/rev/72c147a54bd2
Pushed to comm-aurora: http://hg.mozilla.org/releases/comm-aurora/rev/1ed5fc6ff7b0
Pushed to comm-release: http://hg.mozilla.org/releases/comm-release/rev/43896486d517

Comment 8

[Al Billings [:abillings - ex-MoCo]]

(In reply to Justin Wood (:Callek) from comment #4)
> Dan/Al,
> 
> This is a heads up that SeaMonkey is taking this sec-bug in SeaMonkey 2.13.2
> [to coincide with Firefox/TB 16.0.2 release]
> 
> This particular bug corresponds with
> http://www.mozilla.org/security/announce/2012/mfsa2012-67.html which is
> already publically announced, just something that we missed along the way. I
> will *make sure* it is in our release, even though its not landed yet.

Do we need to update the advisory for 67?

Comment 9

[Justin Wood (:Callek)]

(In reply to Al Billings [:abillings] from comment #8)
> (In reply to Justin Wood (:Callek) from comment #4)
> > Dan/Al,
> > 
> > This is a heads up that SeaMonkey is taking this sec-bug in SeaMonkey 2.13.2
> > [to coincide with Firefox/TB 16.0.2 release]
> > 
> > This particular bug corresponds with
> > http://www.mozilla.org/security/announce/2012/mfsa2012-67.html which is
> > already publically announced, just something that we missed along the way. I
> > will *make sure* it is in our release, even though its not landed yet.
> 
> Do we need to update the advisory for 67?

Yes, To add SeaMonkey 2.13.2, and to list it in SeaMonkey 2.13.2's fixes list.

To deploy to the advisory list along with Firefox 16.0.2's changes.

Dan might have a declaration to issue a new mfsa for SeaMonkey's fix of the same issue however, I'll let him declare that if he thinks so though -- I'm happy to defer that choice

Comment 10

[Frank Wein [:mcsmurf]]

(In reply to Al Billings [:abillings] from comment #8)
> Do we need to update the advisory for 67?

I think you also need to update the advisory for Thunderbird, see Bug 804971 (I cannot access the bug, but I saw the check-in two days or so ago). This issue has not been fixed in TB 15, but will be fixed in the next TB release.