Re: CVE-2017-8805: Unsafe symlinks not filtered in Debian mirror script ftpsync

[Robert Watson <robertcwatson1 () gmail com>]

Since security is determined by file and directory permissions and
ownership, not by symlinks, wouldn't the fact that a malicious user did not
have permissions to access the symlink's target file/directory prevent any
harm?

On Tue, Oct 17, 2017, 12:27 Bastian Blank <waldi () debian org> wrote:

> Hi folks
>
> ftpsync is the tool we use to mirror Debian everywhere.  It uses rsync
> to do the heavy lifting.
>
> rsync can copy symlinks.  We enable this option, as the Debian tree
> includes symlinks in various of locations.  Unless a special option
> (--safe-links) is given, such symlinks can point to arbitrary locations,
> even outside of the mirror tree.
>
> An attacker with the ability to add symlinks to the upstream mirror can
> create symlinks to arbitrary files or even directories.  Depending on
> the config, a HTTP server will follow such symlinks.
>
> Upstream patch:
> ---------------
>   ->
> https://anonscm.debian.org/cgit/mirror/archvsync.git/commit/?id=d1ca2ab2210990b6dfb664cd6776a41b71c48016
>
> Regards,
> Bastian
>
> --
> Beam me up, Scotty!
-- 

Robert "DocSalvager" Watson
... trust in truth keeps hope alive
www.DocSalvage.info