Message233189
Tools/scripts/ftpmirror.py does not guard against arbitrary path constructions, and, given a connection to a malicious FTP server (or a man in the middle attack), it is possible that any file on the client's filesystem gets overwritten. Ie,. if we suppose that ftpmirror.py is run from a "base directory" /home/xxx/yyy, file creations can occur outside this base directory, such as in /tmp, /etc, /var, just to give some examples.
I've constructed a partial proof of concept FTP server that demonstrates directory and file creation outside the base directory (the directory the client script was launched from). I understand that most of the files in Tools/scripts/ are legacy applications that have long been deprecated. However, if the maintainers think these applications should be safe nonetheless, I'll be happy to construct and submit a patch that will remediate this issue.
Guido Vranken
Intelworks |
|
Date |
User |
Action |
Args |
2014-12-30 01:56:34 | Guido | set | recipients:
+ Guido |
2014-12-30 01:56:34 | Guido | set | messageid: <1419904594.24.0.782191401639.issue23130@psf.upfronthosting.co.za> |
2014-12-30 01:56:33 | Guido | link | issue23130 messages |
2014-12-30 01:56:32 | Guido | create | |
|