oss-sec mailing list archives
Re: Re: CVE request for wget
From: Seth Arnold <seth.arnold () canonical com>
Date: Thu, 1 Oct 2015 16:10:46 -0700
On Thu, Oct 01, 2015 at 06:57:26PM -0400, cve-assign () mitre org wrote:
If there is any additional Tails vulnerability related to this, another CVE ID may be needed. For example, https://lists.gnu.org/archive/html/bug-wget/2015-08/msg00050.html says to be 100% sure, you should add --passive-ftp to your command line. If you don't do that, your /etc/wgetrc or ~/.wgetrc could include --no-passive-ftp (or passiveftp = off). If Tails is supposed to try to ensure that, perhaps there's a requirement to have something like: alias wget="wget --passive-ftp" in a system-wide location (possibly /etc/bash.bashrc). The concept of CVE IDs for "failure of a torify step" issues is new, and we aren't sure of the best approach.
I suspect using a bash alias in a site-wide config might then qualify for another CVE in the future, along the lines of "programs that spawn wget via system(3), popen(3), or exec family of functions can use unsafe active mode by accident". If Tails is in the business of fixing these things for safety, removing active ftp support from tools seems like better fix. Thanks
Attachment:
signature.asc
Description: Digital signature
Current thread:
- Re: CVE request for wget cve-assign (Oct 01)
- Re: Re: CVE request for wget Seth Arnold (Oct 01)
- Re: Re: CVE request for wget Austin English (Oct 26)
- Re: Re: CVE request for wget Austin English (Nov 02)
- Re: Re: CVE request for wget Austin English (Nov 03)
- Re: Re: CVE request for wget Austin English (Dec 24)
- Re: Re: CVE request for wget Austin English (Oct 26)
- Re: Re: CVE request for wget Seth Arnold (Oct 01)