Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 21 May 2010 07:32:31 +0400
From: Solar Designer <>
Subject: Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability

On Fri, May 21, 2010 at 12:53:12AM +0400, Solar Designer wrote:
> I brought this issue to the bug-wget list:
> [Bug-wget] security risk of unexpected download filenames

Micah, the previous wget maintainer who is still active on the bug-wget
list, has commented on the issue:

It sounds like he does not mind a fix like Florian's patch getting
included upstream.  We'll see what the current maintainers say.

In another bug-wget posting, I described an attack that does not involve
a Unix user's home directory and a dot-file:

It works against wget of a file into a website "document root" tree and
it may take advantage of index.html taking precedence over index.php.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.