Re: Links < 2.1 security issue

[Nico Golde <oss-security+ml () ngolde de>]

Hi Steven,
* Steven M. Christey <coley () linus mitre org> [2008-07-28 00:24]:
> On Sun, 27 Jul 2008, Pierre-Yves Rofes wrote:
>
> > Anyone investigated this, or even has a clue on the potential impact?
> > Not sure if a CVE can be assigned, since this is very (too?) vague...
>
> We operate on the assumption that if a developer says it's a security
> issue, it's worth assigning a CVE for.
>
> But you wind up with uninformative descriptions like the one below :-/

As far as I understand the patch fixes two problems:
diff -ur new/links2-2.1pre37/url.c upstream/links-2.1/url.c
--- new/links2-2.1pre37/url.c   2007-12-26 04:00:49.000000000 +0000
+++ upstream/links-2.1/url.c    2008-06-29 16:47:21.000000000 +0000
@@ -16,7 +16,7 @@
        int allow_post;
        int bypasses_socks;
 } protocols[]= {
-               {"file", 0, file_func, NULL,            1, 1, 0, 0, 0},
+               {"file", 0, file_func, NULL,            1, 1, 0, 0, 1},
                {"https", 443, https_func, NULL,        0, 1, 1, 1, 0},
                {"http", 80, http_func, NULL,           0, 1, 1, 1, 0},
                {"proxy", 3128, proxy_func, NULL,       0, 1, 1, 1, 0},

This does nothing more than setting the socks bypass option to 1 allowing
links to not use the socks proxy for local file urls.

The second part seems to be the actual security issue:
diff -ur new/links2-2.1pre37/session.c upstream/links-2.1/session.c
--- new/links2-2.1pre37/session.c       2008-06-21 16:12:07.000000000 +0000
+++ upstream/links-2.1/session.c        2008-06-29 16:47:21.000000000 +0000
@@ -2317,6 +2317,7 @@
        if (a->accept_http && !strcasecmp(proto, "http")) ret = 1;
        if (a->accept_ftp && !strcasecmp(proto, "ftp")) ret = 1;
        mem_free(proto);
+       if (proxies.only_proxies) ret = 0;
        return ret;
 }

Before the patch this set ses->tq_prog_flag_direct to 1 which causes the
continue_download() function to pass the url to an external program (after
links identified the file type) and thus bypassing the socks proxy (e.g. tor)
even if you have configured links to never use anything else than the proxy
(proxies.only_proxies). This should be a problem for example if you rely on the
anonymity you don't have in this case.

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

Attachment: _bin
Description: