oss-sec mailing list archives
Re: viewvc security flaw?
From: Robert Buchholz <rbu () gentoo org>
Date: Sat, 20 Sep 2008 12:06:28 +0200
On Friday, 19. September 2008, Josh Bressers wrote:
I'm not sure about this one, I'm wondering if someone else has an opinion: http://viewvc.tigris.org/issues/show_bug.cgi?id=354 It was submitted as a Fedora security update, which I'm letting through for now, as better safe than sorry. To sum it up, it looks like the mime type used to display a given file in viewvc can be set via the URL. Obviously this means that an attacker could force an arbitrary mime type on any file in a viewvc repository. It strikes me as not crossing a trust boundary though, as I suspect you'd need something malicious in the repo in order for this to really be useful. If the bad guys can already add arbitrary content, you have bigger problems.
We also just received this report as upstream announced it as a security issue. Nevertheless, I would follow your argument. A crafted link could at worst case crash the browser. But as far as I can imagine nothing inside the repository can be exploited by changing its mime-type at delivery. Robert
Attachment:
signature.asc
Description: This is a digitally signed message part.
Current thread:
- viewvc security flaw? Josh Bressers (Sep 19)
- Re: viewvc security flaw? Robert Buchholz (Sep 20)