[Bug 1091473]

[Jamie Strandboge]

Thank you for reporting this bug to Ubuntu. hardy has reached EOL
(End of Life) for this package and is no longer supported. As
a result, this bug against hardy is being marked "Won't Fix".
Please see https://wiki.ubuntu.com/Releases for currently
supported Ubuntu releases.

Please feel free to report any other bugs you may find.

** Changed in: grep (Ubuntu Hardy)
       Status: Triaged => Won't Fix

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grep in Ubuntu.
https://bugs.launchpad.net/bugs/1091473

Title:
  grep <2.11 is vulnerable to "Arbitrary command execution"

Status in “grep” package in Ubuntu:
  Fix Released
Status in “grep” source package in Lucid:
  Triaged
Status in “grep” source package in Oneiric:
  Won't Fix
Status in “grep” source package in Precise:
  Triaged
Status in “grep” source package in Quantal:
  Fix Released
Status in “grep” source package in Raring:
  Fix Released
Status in “grep” source package in Hardy:
  Won't Fix

Bug description:
  grep <2.11 is vulnerable to command execution vulnerability, and it is
  not possible to patch unless you build the source directly from the
  git repo.

  ubuntu 12.04(And everything else, I would assume) uses version 2.10 of
  grep. it is not possible to upgrade without downloading the src and
  building it yourself.


  
  PoC:

  perl -e 'print "x"x(2**31)' | grep x > /dev/null

  This is the grep news form for this:

   * Noteworthy changes in release 2.11 (2012-03-02) [stable]

    ** Bug fixes

      grep no longer dumps core on lines whose lengths do not fit in 'int'.
      (e.g., lines longer than 2 GiB on a typical 64-bit host).
      Instead, grep either works as expected, or reports an error.
      An error can occur if not enough main memory is available, or if the
      GNU C library's regular expression functions cannot handle such long lines.
      [bug present since "the beginning"]


  Solution: Send out a grep update with atleast 2.11 grep from
  http://git.sv.gnu.org/cgit/grep.git


  Full PoC of actually "abusing" this vulnerablility(ls -la within grep)
  can be provided, if 100% needed.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grep/+bug/1091473/+subscriptions