[<prev] [next>] [day] [month] [year] [list]
Message-ID: <56B9555C.9090009@geeklan.co.uk>
Date: Tue, 9 Feb 2016 02:56:28 +0000
From: Sevan Janiyan <venture37@...klan.co.uk>
To: oss-security@...ts.openwall.com
Subject: Libreoffice updater runs over http
Hi,
Looking into the validity of an issue which was reported[1] a couple of
years back, it seems that it's still possible to spoof the availability
of an update for LibreOffice.
Unfortunately, I've not been able to get the download to happen as I
need to look into what happens when the application requests PROPFIND
/check.php?pkgfmt=dmg HTTP/1.1
At this point the download is marked as stalled whilst attempting to
download LibreOffice 9.9.9 I'd announced.
Though the original report used Windows, I repeated on OS X trying to
see if libreoffice could just download a mp4 video, later changed to a dmg.
Using the following check.php
<?php
echo '<?xml version="1.0" encoding="utf-8"?>
<inst:description xmlns:inst="http://update.libreoffice.org/description">
<inst:id>LibreOffice 9.9.9</inst:id>
<inst:gitid>123456789</inst:gitid>
<inst:os>MacOSX</inst:os>
<inst:arch>x86</inst:arch>
<inst:version>9.9.9</inst:version>
<inst:buildid>9999</inst:buildid>
<inst:update type="application/octet-stream"
src="http://update.libreoffice.org/update.dmg"/>
</inst:description>';
?>
Is this of concern at this stage?
Sevan
[1] http://www.waraxe.us/advisory-99.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
