oss-sec mailing list archives
Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync
From: Robert Watson <robertcwatson1 () gmail com>
Date: Wed, 18 Oct 2017 12:55:21 +0000
Since security is determined by file and directory permissions and ownership, not by symlinks, wouldn't the fact that a malicious user did not have permissions to access the symlink's target file/directory prevent any harm? On Tue, Oct 17, 2017, 12:27 Bastian Blank <waldi () debian org> wrote:
Hi folks ftpsync is the tool we use to mirror Debian everywhere. It uses rsync to do the heavy lifting. rsync can copy symlinks. We enable this option, as the Debian tree includes symlinks in various of locations. Unless a special option (--safe-links) is given, such symlinks can point to arbitrary locations, even outside of the mirror tree. An attacker with the ability to add symlinks to the upstream mirror can create symlinks to arbitrary files or even directories. Depending on the config, a HTTP server will follow such symlinks. Upstream patch: --------------- -> https://anonscm.debian.org/cgit/mirror/archvsync.git/commit/?id=d1ca2ab2210990b6dfb664cd6776a41b71c48016 Regards, Bastian -- Beam me up, Scotty!
-- Robert "DocSalvager" Watson ... trust in truth keeps hope alive www.DocSalvage.info
Current thread:
- CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Bastian Blank (Oct 17)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Robert Watson (Oct 18)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Ben Tasker (Oct 18)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Robert Watson (Oct 19)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Seth Arnold (Oct 19)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Robert Watson (Oct 20)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Ben Tasker (Oct 20)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Robert Watson (Oct 21)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Solar Designer (Oct 21)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Robert Watson (Oct 21)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Simon McVittie (Oct 21)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Ben Tasker (Oct 18)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Robert Watson (Oct 18)
- Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync Seth Arnold (Oct 20)