[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171017162507.e7lx6fbnleugoxxa@waldi.eu.org>
Date: Tue, 17 Oct 2017 18:25:07 +0200
From: Bastian Blank <waldi@...ian.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script
ftpsync
Hi folks
ftpsync is the tool we use to mirror Debian everywhere. It uses rsync
to do the heavy lifting.
rsync can copy symlinks. We enable this option, as the Debian tree
includes symlinks in various of locations. Unless a special option
(--safe-links) is given, such symlinks can point to arbitrary locations,
even outside of the mirror tree.
An attacker with the ability to add symlinks to the upstream mirror can
create symlinks to arbitrary files or even directories. Depending on
the config, a HTTP server will follow such symlinks.
Upstream patch:
---------------
-> https://anonscm.debian.org/cgit/mirror/archvsync.git/commit/?id=d1ca2ab2210990b6dfb664cd6776a41b71c48016
Regards,
Bastian
--
Beam me up, Scotty!
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
