oss-sec mailing list archives
Re: Links < 2.1 security issue
From: Nico Golde <oss-security+ml () ngolde de>
Date: Mon, 28 Jul 2008 20:27:21 +0200
Hi Steven, * Steven M. Christey <coley () linus mitre org> [2008-07-28 00:24]:
On Sun, 27 Jul 2008, Pierre-Yves Rofes wrote:Anyone investigated this, or even has a clue on the potential impact? Not sure if a CVE can be assigned, since this is very (too?) vague...We operate on the assumption that if a developer says it's a security issue, it's worth assigning a CVE for. But you wind up with uninformative descriptions like the one below :-/
As far as I understand the patch fixes two problems: diff -ur new/links2-2.1pre37/url.c upstream/links-2.1/url.c --- new/links2-2.1pre37/url.c 2007-12-26 04:00:49.000000000 +0000 +++ upstream/links-2.1/url.c 2008-06-29 16:47:21.000000000 +0000 @@ -16,7 +16,7 @@ int allow_post; int bypasses_socks; } protocols[]= { - {"file", 0, file_func, NULL, 1, 1, 0, 0, 0}, + {"file", 0, file_func, NULL, 1, 1, 0, 0, 1}, {"https", 443, https_func, NULL, 0, 1, 1, 1, 0}, {"http", 80, http_func, NULL, 0, 1, 1, 1, 0}, {"proxy", 3128, proxy_func, NULL, 0, 1, 1, 1, 0}, This does nothing more than setting the socks bypass option to 1 allowing links to not use the socks proxy for local file urls. The second part seems to be the actual security issue: diff -ur new/links2-2.1pre37/session.c upstream/links-2.1/session.c --- new/links2-2.1pre37/session.c 2008-06-21 16:12:07.000000000 +0000 +++ upstream/links-2.1/session.c 2008-06-29 16:47:21.000000000 +0000 @@ -2317,6 +2317,7 @@ if (a->accept_http && !strcasecmp(proto, "http")) ret = 1; if (a->accept_ftp && !strcasecmp(proto, "ftp")) ret = 1; mem_free(proto); + if (proxies.only_proxies) ret = 0; return ret; } Before the patch this set ses->tq_prog_flag_direct to 1 which causes the continue_download() function to pass the url to an external program (after links identified the file type) and thus bypassing the socks proxy (e.g. tor) even if you have configured links to never use anything else than the proxy (proxies.only_proxies). This should be a problem for example if you rely on the anonymity you don't have in this case. Cheers Nico -- Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted.
Attachment:
_bin
Description:
Current thread:
- Links < 2.1 security issue Pierre-Yves Rofes (Jul 27)
- Re: Links < 2.1 security issue Steven M. Christey (Jul 27)
- Re: Links < 2.1 security issue Nico Golde (Jul 28)
- Re: Links < 2.1 security issue Steven M. Christey (Jul 27)