oss-sec mailing list archives
CVE Request: GeoIP Directory traversal weakness in geoipupdate
From: Anthon Pang <anthon.pang () gmail com>
Date: Fri, 20 May 2011 11:58:24 -0400
Since this was previosly assigned a CVE ID, i.e., CVE-2007-0159, I'm requesting a new one for the incomplete fix in 1.4.1, and the new issue introduced in 1.4.5. The GeoIP C API is an open source library (LGPL) for MaxMind's GeoIP data products. GeoIP-1.4.7.tar.gz (the latest version) contains a directory traversal weakness whereby a remote malicious update server (responding to requests at updates.maxmind.com) may overwrite arbitrary files. apps/geoipupdate.c, added a sanity check in 1.4.1 but does not handle Windows paths containing backslash or colon. apps/geoipupdate-pureperl.pl, introduced in 1.4.5, does not filter any filenames returned by the remote server. The fix is to reject invalid filenames, e.g., leading '.', or containing slash, backslash (Windows), or colons (Windows).
Current thread:
- CVE Request: GeoIP Directory traversal weakness in geoipupdate Anthon Pang (May 20)