[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAOfWR+EHYftu3Hqbu0qGvk_kk3au-Gkj_WEH95syC3n-QuNnxg@mail.gmail.com>
Date: Wed, 18 Oct 2017 12:55:21 +0000
From: Robert Watson <robertcwatson1@...il.com>
To: oss-security@...ts.openwall.com, Bastian Blank <waldi@...ian.org>
Subject: Re: CVE-2017-8805: Unsafe symlinks not filtered in
Debian mirror script ftpsync
Since security is determined by file and directory permissions and
ownership, not by symlinks, wouldn't the fact that a malicious user did not
have permissions to access the symlink's target file/directory prevent any
harm?
On Tue, Oct 17, 2017, 12:27 Bastian Blank <waldi@...ian.org> wrote:
> Hi folks
>
> ftpsync is the tool we use to mirror Debian everywhere. It uses rsync
> to do the heavy lifting.
>
> rsync can copy symlinks. We enable this option, as the Debian tree
> includes symlinks in various of locations. Unless a special option
> (--safe-links) is given, such symlinks can point to arbitrary locations,
> even outside of the mirror tree.
>
> An attacker with the ability to add symlinks to the upstream mirror can
> create symlinks to arbitrary files or even directories. Depending on
> the config, a HTTP server will follow such symlinks.
>
> Upstream patch:
> ---------------
> ->
> https://anonscm.debian.org/cgit/mirror/archvsync.git/commit/?id=d1ca2ab2210990b6dfb664cd6776a41b71c48016
>
> Regards,
> Bastian
>
> --
> Beam me up, Scotty!
>
--
Robert "DocSalvager" Watson
... trust in truth keeps hope alive
www.DocSalvage.info
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
