Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 1 Oct 2015 16:10:46 -0700
From: Seth Arnold <>
Subject: Re: Re: CVE request for wget

On Thu, Oct 01, 2015 at 06:57:26PM -0400, wrote:
> If there is any additional Tails vulnerability related to this,
> another CVE ID may be needed. For example,
> says
>   to be 100% sure, you should add --passive-ftp to your command line.
>   If you don't do that, your /etc/wgetrc or ~/.wgetrc could include
>   --no-passive-ftp (or passiveftp = off).
> If Tails is supposed to try to ensure that, perhaps there's a
> requirement to have something like:
>   alias wget="wget --passive-ftp"
> in a system-wide location (possibly /etc/bash.bashrc). The concept of
> CVE IDs for "failure of a torify step" issues is new, and we aren't
> sure of the best approach.

I suspect using a bash alias in a site-wide config might then qualify for
another CVE in the future, along the lines of "programs that spawn wget
via system(3), popen(3), or exec family of functions can use unsafe active
mode by accident". If Tails is in the business of fixing these things
for safety, removing active ftp support from tools seems like better fix.


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.