oss-security - Re: CVE Request - Gnu Wget 1.17

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <E91F67A6-D25F-47ED-A6E5-14A4C6BDBD66@verisign.com>
Date: Sun, 28 Aug 2016 05:56:27 +0000
From: "Misra, Deapesh" <dmisra@...isign.com>
To: "cve-assign@...re.org" <cve-assign@...re.org>
CC: "dawid@...alhackers.com" <dawid@...alhackers.com>,
        "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: CVE Request - Gnu Wget 1.17 - Design Error Vulnerability

Hi,

> On Aug 27, 2016, at 3:08 PM, "cve-assign@...re.org" <cve-assign@...re.org> wrote:
> 
> Maybe a marginally realistic exploitation scenario is for the
> attacker to convey this message to potential victims:

When I read the vulnerability report for the first time, this is the scenario I came up with to justify the security threat from this issue:

(Hypothetical story of course)
A group of developers decide to write their own version of the "internet archive - way back machine". To keep things simple they decide to use the power of wget within their PHP app. 

For their version one of the app, they decide to only allow the archiving and viewing of jpeg files. 

They then set up their PHP app and solicit people to input in URLs of websites with images which need to be archived.

In this kind of "archiving website" scenario, the victim has to 
- solicit and accept URLs from untrustworthy parties
- has to archive the specified files and then make the archived files available

Isn't this a common enough and plausible scenario which poses a security threat to the developers server ?

Thanks,
- deapesh.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.