Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 20 Sep 2008 12:06:28 +0200
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: viewvc security flaw?

On Friday, 19. September 2008, Josh Bressers wrote:
> I'm not sure about this one, I'm wondering if someone else has an
> opinion: http://viewvc.tigris.org/issues/show_bug.cgi?id=354
>
> It was submitted as a Fedora security update, which I'm letting through
> for now, as better safe than sorry.
>
> To sum it up, it looks like the mime type used to display a given file
> in viewvc can be set via the URL.  Obviously this means that an attacker
> could force an arbitrary mime type on any file in a viewvc repository.
>
> It strikes me as not crossing a trust boundary though, as I suspect
> you'd need something malicious in the repo in order for this to really
> be useful.  If the bad guys can already add arbitrary content, you have
> bigger problems.

We also just received this report as upstream announced it as a security 
issue. Nevertheless, I would follow your argument. A crafted link could at 
worst case crash the browser. But as far as I can imagine nothing inside 
the repository can be exploited by changing its mime-type at delivery.

Robert

Download attachment "signature.asc " of type "application/pgp-signature" (828 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.