[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1609131447570.990@freddy.simplesystems.org>
Date: Tue, 13 Sep 2016 14:57:01 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: libxml with CGI fix
On Tue, 13 Sep 2016, watashiwaher wrote:
> Hi, huys! There is a known httpoxy vulnerability ( https://httpoxy.org/ ).
> There is a problem with CGI usage in all application which use libxml2
> library. Attacker can make requests via attacker proxy from target server
> using this vulnerability. I reported this problem in the 5th august, but
> developers didn't reply me at all, and I don't know if they want to
> response.
The referenced web site provides the advice "Do it “at the edge”,
where HTTP requests first enter your system.". In this case libxml2
is not the edge. The edge is the parser which accepts the CGI
requests.
Adding detection of "REQUEST_METHOD" to libxml2 may reduce the
potential menace.
The libxml2 developers should have responded to you but I can see why
they would not consider this to be their problem.
If you break libxml2 support for HTTP_PROXY (and/or http_proxy) then
the proxy capabilty can't be used outside of CGI applications, which
is likely to break existing valid uses.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
