Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 13 Sep 2016 14:57:01 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: libxml with CGI fix

On Tue, 13 Sep 2016, watashiwaher wrote:

> Hi, huys! There is a known httpoxy vulnerability ( https://httpoxy.org/ ).
> There is a problem with CGI usage in all application which use libxml2
> library. Attacker can make requests via attacker proxy from target server
> using this vulnerability. I reported this problem in the 5th august, but
> developers didn't reply me at all, and I don't know if they want to
> response.

The referenced web site provides the advice "Do it “at the edge”, 
where HTTP requests first enter your system.".  In this case libxml2 
is not the edge.  The edge is the parser which accepts the CGI 
requests.

Adding detection of "REQUEST_METHOD" to libxml2 may reduce the 
potential menace.

The libxml2 developers should have responded to you but I can see why 
they would not consider this to be their problem.

If you break libxml2 support for HTTP_PROXY (and/or http_proxy) then 
the proxy capabilty can't be used outside of CGI applications, which 
is likely to break existing valid uses.

Bob
-- 
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.