[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 9 Sep 2015 09:52:44 +0200
From: Andreas Stieger <astieger@...e.com>
To: oss-security@...ts.openwall.com
Cc: austinenglish@...il.com, cve-assign@...re.org
Subject: Re: CVE request for wget
Hello,
On 09/07/2015 10:39 PM, Austin English wrote:
> This was reported to tails-dev [1] and other places [2] and is fixed
> upstream [3].
>
> I've rebased the patch for 1.13.4 (attached), which is the current
> version in Debian wheezy [4] that Tails is based on.
>
> Please keep me in CC, as I'm not subscribed.
>
> [1] https://mailman.boum.org/pipermail/tails-dev/2015-August/009370.html
> [2] https://lists.gnu.org/archive/html/bug-wget/2015-08/msg00020.html
> [3] http://git.savannah.gnu.org/cgit/wget.git/commit/?id=075d7556964f5a871a73c22ac4b69f5361295099
> [4] https://packages.debian.org/wheezy/wget
To reproduce:
A $> nc -lv 8020
B $> wget ftp://A:8020
On A keep entering "200 ok", the following will be printed:
> $ wget ftp://dexter:8020 > --2015-09-08 17:11:30-- ftp://dexter:8020/ > =>
‘.listing’ > Resolving dexter (dexter)... 10.160.4.160 > Connecting to
dexter (dexter)|10.160.4.160|:8020... connected. > Logging in as
anonymous ... Logged in! > ==> SYST ... done. ==> PWD ... done. > ==>
TYPE I ... done. ==> CWD not needed. > ==> PASV ... > Cannot parse PASV
response. > ==> PORT ...
On the server side:
> $ nc -lv 8020 > Connection from 10.160.4.160 port 8020 [tcp/intu-ec-svcdisc] accepted
> 200 ok > USER anonymous > 200 ok > SYST > 200 ok > PWD > 200 ok > TYPE
I > 200 ok > PASV > 200 ok > PORT 10,160,4,160,134,42
^^^^^^^^^^^^
This would affect IP users connecting through a privacy proxy or VPN,
leaking their public IP address if they are otherwise connected without
NAT. For users connecting without such a proxy but through NAT, it leaks
the internal IP address.
https://bugzilla.suse.com/show_bug.cgi?id=944858
Andreas
--
Andreas Stieger <astieger@...e.com>
Project Manager Security
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)
Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
