Polkit authentification can be bypassed

This patch should fix the authorization bypass

A possible fix for the code injection would be : check if sysLang and sysLanguage are found in the language list (see "data" directory), if they are not found the method could throw an error...

This affects maverick and natty. language-selector in <= lucid doesn't use policykit.

I don't think it's easily possible to verify if the language is installed on the system (for example LANGUAGE can contain multiple ":" seperated languages).
Instead it should only make sure that one cannot inject shell commands.
This regex should do that: ^[\w\.\-@:]+$

To test the patch you can call:
dbus-send --system --print-reply --dest=com.ubuntu.LanguageSelector / com.ubuntu.LanguageSelector.SetSystemDefaultLanguageEnv string:"abc\" EVIL_COMMAND && true \"xyz"

The old version writes LANGUAGE="abc" EVIL_COMMAND && true "xyz" to /etc/default/locale even when canceling the auth dialog.
The patched one always returns false.

Thanks for the patch! I confirm that these are the only two places where this is used.

Security team, do you want a coordinated disclosure for this once the maverick and natty patches are ready, or can we fix this in natty now and make this bug public?

I also updated Felix' patch a bit and applied it as well.

Both fixes are sitting in the natty bzr branch on my local machine now, but I didn't push yet as this bug is still private.

I now also prepared a maverick branch with the backported fixes (also not pushed to LP yet).

@Martin, I can push this for Maverick today. Could you attach your updated patch for Maverick?

Also, I assume this only affects Ubuntu, and doesn't need coordination with any other distro?

This is the maverick debdiff.

Some downstream derivatives of Ubuntu might use that (Mint, etc.?). Debian, Fedora, SUSE don't use it.

Jamie said that we should wait with this until Kees assigns a CVE, as it's originating from Ubuntu.

CVE-2011-0729

This bug was fixed in the package language-selector - 0.6.7

---------------
language-selector (0.6.7) maverick-security; urgency=low

  [ Kees Cook ]
  * SECURITY UPDATE: language selector backend did not verify policy kit
    authentication.
    - debian/language-selector-common.postinst: shut down old backend.
    - CVE-2011-0729

  [ Martin Pitt ]
  * dbus_backend/ls-dbus-backend: Actually look at the PolicyKit check result
    and only proceed if it succeeded. Thanks to Romain Perier for finding this
    and providing the patch! This fixes a local root privilege escalation, as
    this allows any authenticated user to write arbitrary shell commands into
    /etc/default/locale. (LP: #764397)
  * dbus_backend/ls-dbus-backend: Reject locale names with invalid characters
    in it, to further prevent injecting shell code into /etc/default/locale
    for authenticated users. Thanks to Felix Geyer for the initial patch!
    (LP: #764397)
  * debian/control: Update Vcs-Bzr: for newly created maverick branch.
 -- Kees Cook <email address hidden> Tue, 19 Apr 2011 10:31:37 -0700

This bug was fixed in the package language-selector - 0.33

---------------
language-selector (0.33) natty; urgency=low

  * dbus_backend/ls-dbus-backend: Actually look at the PolicyKit check result
    and only proceed if it succeeded. Thanks to Romain Perier for finding this
    and providing the patch! This fixes a local root privilege escalation, as
    this allows any authenticated user to write arbitrary shell commands into
    /etc/default/locale. (LP: #764397) [CVE-2011-0729]
  * dbus_backend/ls-dbus-backend: Reject locale names with invalid characters
    in it, to further prevent injecting shell code into /etc/default/locale
    for authenticated users. Thanks to Felix Geyer for the initial patch!
    (LP: #764397)
  * dbus_backend/com.ubuntu.LanguageSelector.conf: Allow access to standard
    D-BUS introspection and properties interfaces. There's no reason to deny
    it, and it causes warnings.
  * debian/language-selector-common.postinst: Stop running D-BUS backend on
    upgrade.
 -- Martin Pitt <email address hidden> Tue, 19 Apr 2011 20:20:44 +0200