[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 20 May 2011 11:58:24 -0400
From: Anthon Pang <anthon.pang@...il.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: CVE Request: GeoIP Directory traversal weakness in geoipupdate
Since this was previosly assigned a CVE ID, i.e., CVE-2007-0159, I'm
requesting a new one for the incomplete fix in 1.4.1, and the new issue
introduced in 1.4.5.
The GeoIP C API is an open source library (LGPL) for MaxMind's GeoIP data
products.
GeoIP-1.4.7.tar.gz (the latest version) contains a directory traversal
weakness whereby a remote malicious update server (responding to requests at
updates.maxmind.com) may overwrite arbitrary files.
apps/geoipupdate.c, added a sanity check in 1.4.1 but does not handle
Windows paths containing backslash or colon.
apps/geoipupdate-pureperl.pl, introduced in 1.4.5, does not filter any
filenames returned by the remote server.
The fix is to reject invalid filenames, e.g., leading '.', or containing
slash, backslash (Windows), or colons (Windows).
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
