[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20080728182721.GB896@ngolde.de>
Date: Mon, 28 Jul 2008 20:27:21 +0200
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Subject: Re: Links < 2.1 security issue
Hi Steven,
* Steven M. Christey <coley@...us.mitre.org> [2008-07-28 00:24]:
> On Sun, 27 Jul 2008, Pierre-Yves Rofes wrote:
>
> > Anyone investigated this, or even has a clue on the potential impact?
> > Not sure if a CVE can be assigned, since this is very (too?) vague...
>
> We operate on the assumption that if a developer says it's a security
> issue, it's worth assigning a CVE for.
>
> But you wind up with uninformative descriptions like the one below :-/
As far as I understand the patch fixes two problems:
diff -ur new/links2-2.1pre37/url.c upstream/links-2.1/url.c
--- new/links2-2.1pre37/url.c 2007-12-26 04:00:49.000000000 +0000
+++ upstream/links-2.1/url.c 2008-06-29 16:47:21.000000000 +0000
@@ -16,7 +16,7 @@
int allow_post;
int bypasses_socks;
} protocols[]= {
- {"file", 0, file_func, NULL, 1, 1, 0, 0, 0},
+ {"file", 0, file_func, NULL, 1, 1, 0, 0, 1},
{"https", 443, https_func, NULL, 0, 1, 1, 1, 0},
{"http", 80, http_func, NULL, 0, 1, 1, 1, 0},
{"proxy", 3128, proxy_func, NULL, 0, 1, 1, 1, 0},
This does nothing more than setting the socks bypass option to 1 allowing
links to not use the socks proxy for local file urls.
The second part seems to be the actual security issue:
diff -ur new/links2-2.1pre37/session.c upstream/links-2.1/session.c
--- new/links2-2.1pre37/session.c 2008-06-21 16:12:07.000000000 +0000
+++ upstream/links-2.1/session.c 2008-06-29 16:47:21.000000000 +0000
@@ -2317,6 +2317,7 @@
if (a->accept_http && !strcasecmp(proto, "http")) ret = 1;
if (a->accept_ftp && !strcasecmp(proto, "ftp")) ret = 1;
mem_free(proto);
+ if (proxies.only_proxies) ret = 0;
return ret;
}
Before the patch this set ses->tq_prog_flag_direct to 1 which causes the
continue_download() function to pass the url to an external program (after
links identified the file type) and thus bypassing the socks proxy (e.g. tor)
even if you have configured links to never use anything else than the proxy
(proxies.only_proxies). This should be a problem for example if you rely on the
anonymity you don't have in this case.
Cheers
Nico
--
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
