Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 2 Nov 2016 13:57:35 +0100 (CET)
From: Daniel Stenberg <daniel@...x.se>
To: Robert Scheck <robert@...oraproject.org>
cc: oss-security@...ts.openwall.com
Subject: Re: [SECURITY ADVISORY] IDNA 2003 makes curl use
 wrong host

On Wed, 2 Nov 2016, Robert Scheck wrote:

>> curl is not alone with this problem, as there's currently a big flux in the
>> world of network user-agents about which IDNA version to support and use.
>
> From my point of view, this especially affects GNU libc for example.
>
> On the other hand, I am wondering if this should be really classified as a 
> security related issue.

Can this be used to trick users or give malicious actors an advantage? I think 
yes. I think it has a security impact. To what extent can be debated, but then 
I don't grade our security vulnerabilites.

> I guess many upstreams should be explicitly made aware of that soon. Maybe 
> MITRE (or somebody else) could share their thoughts about this, too?

I would say so. Since IDNA2003 and IDNA2008 make clients end up on different 
target machines, there's no doubt in my mind that this *can* be abused. I'm 
confident that many other tools and libraries in addition to curl have the 
same problem.

> I reported the "ß" issue and the lack of IDNA 2008 support in cURL on Sun, 
> 18 May 2014 17:17:03 +0200 directly to you, but I didn't classify it as a 
> security related issue though... ;-)

Then I appologize for having dropped the ball and not having seen the problem 
correctly back then. I don't remember that occasion, but I believe you.

NOTE: the IDNA 2008 fix seems to be incomplete [1] so right now it is probably 
better to just disable IDN support in curl, at least if libidn2 powered.

[1] = https://curl.haxx.se/mail/lib-2016-11/0033.html

-- 

  / daniel.haxx.se

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.