Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 9 Sep 2015 09:52:44 +0200
From: Andreas Stieger <astieger@...e.com>
To: oss-security@...ts.openwall.com
Cc: austinenglish@...il.com, cve-assign@...re.org
Subject: Re: CVE request for wget

Hello,

On 09/07/2015 10:39 PM, Austin English wrote:
> This was reported to tails-dev [1] and other places [2] and is fixed
> upstream [3].
>
> I've rebased the patch for 1.13.4 (attached), which is the current
> version in Debian wheezy [4] that Tails is based on.
>
> Please keep me in CC, as I'm not subscribed.
>
> [1] https://mailman.boum.org/pipermail/tails-dev/2015-August/009370.html
> [2] https://lists.gnu.org/archive/html/bug-wget/2015-08/msg00020.html
> [3] http://git.savannah.gnu.org/cgit/wget.git/commit/?id=075d7556964f5a871a73c22ac4b69f5361295099
> [4] https://packages.debian.org/wheezy/wget

To reproduce:

A $> nc -lv 8020
B $> wget ftp://A:8020

On A keep entering "200 ok", the following will be printed:

> $ wget ftp://dexter:8020 > --2015-09-08 17:11:30-- ftp://dexter:8020/ > =>
‘.listing’ > Resolving dexter (dexter)... 10.160.4.160 > Connecting to
dexter (dexter)|10.160.4.160|:8020... connected. > Logging in as
anonymous ... Logged in! > ==> SYST ... done. ==> PWD ... done. > ==>
TYPE I ... done. ==> CWD not needed. > ==> PASV ... > Cannot parse PASV
response. > ==> PORT ...

On the server side:

> $ nc -lv 8020 > Connection from 10.160.4.160 port 8020 [tcp/intu-ec-svcdisc] accepted
> 200 ok > USER anonymous > 200 ok > SYST > 200 ok > PWD > 200 ok > TYPE
I > 200 ok > PASV > 200 ok > PORT 10,160,4,160,134,42
       ^^^^^^^^^^^^

This would affect IP users connecting through a privacy proxy or VPN,
leaking their public IP address if they are otherwise connected without
NAT. For users connecting without such a proxy but through NAT, it leaks
the internal IP address.

https://bugzilla.suse.com/show_bug.cgi?id=944858

Andreas

-- 
Andreas Stieger <astieger@...e.com>
Project Manager Security
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)



Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.