[Bug 40347] New: unmount uses unsafe system()

https://bugs.winehq.org/show_bug.cgi?id=40347

Bug ID: 40347
           Summary: unmount uses unsafe system()
           Product: Wine
           Version: unspecified
          Hardware: x86
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Created attachment 54037
  --> https://bugs.winehq.org/attachment.cgi?id=54037
eject source file

DIR_unmount_device from wine/dlls/ntdll/directory.c doesn't sanitize its input
leading to a possible command execution by unmounting a device mounted on a
malicious path.

To reproduce (from Michael Müller):

$ mkdir "a;xterm"
    $ mount "a;xterm"
    $ ./eject  # launches xterm

where eject is built from the attached code.

[Bug 40347] unmount uses unsafe system()

https://bugs.winehq.org/show_bug.cgi?id=40347

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 40347] unmount uses unsafe system()

https://bugs.winehq.org/show_bug.cgi?id=40347

Jactry Zeng  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]