oss-sec mailing list archives
Libreoffice updater runs over http
From: Sevan Janiyan <venture37 () geeklan co uk>
Date: Tue, 9 Feb 2016 02:56:28 +0000
Hi, Looking into the validity of an issue which was reported[1] a couple of years back, it seems that it's still possible to spoof the availability of an update for LibreOffice. Unfortunately, I've not been able to get the download to happen as I need to look into what happens when the application requests PROPFIND /check.php?pkgfmt=dmg HTTP/1.1 At this point the download is marked as stalled whilst attempting to download LibreOffice 9.9.9 I'd announced. Though the original report used Windows, I repeated on OS X trying to see if libreoffice could just download a mp4 video, later changed to a dmg. Using the following check.php <?php echo '<?xml version="1.0" encoding="utf-8"?> <inst:description xmlns:inst="http://update.libreoffice.org/description"> <inst:id>LibreOffice 9.9.9</inst:id> <inst:gitid>123456789</inst:gitid> <inst:os>MacOSX</inst:os> <inst:arch>x86</inst:arch> <inst:version>9.9.9</inst:version> <inst:buildid>9999</inst:buildid> <inst:update type="application/octet-stream" src="http://update.libreoffice.org/update.dmg"/> </inst:description>'; ?> Is this of concern at this stage? Sevan [1] http://www.waraxe.us/advisory-99.html
Current thread:
- Libreoffice updater runs over http Sevan Janiyan (Feb 08)