diff options
| author | Darshit Shah <darnir@gmail.com> | 2014-09-08 00:41:17 +0530 |
|---|---|---|
| committer | Giuseppe Scrivano <gscrivan@redhat.com> | 2014-10-27 09:18:13 +0100 |
| commit | 18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7 (patch) | |
| tree | de45b56079afb39b168e1026299c7c1e6f511696 | |
| parent | c986ea790c59ad956fff514e2b007808e8d67cb3 (diff) | |
| download | wget-18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7.tar.gz | |
CVE-2014-4877: Arbitrary Symlink Access
Wget was susceptible to a symlink attack which could create arbitrary
files, directories or symbolic links and set their permissions when
retrieving a directory recursively through FTP. This commit changes the
default settings in Wget such that Wget no longer creates local symbolic
links, but rather traverses them and retrieves the pointed-to file in
such a retrieval.
The old behaviour can be attained by passing the --retr-symlinks=no
option to the Wget invokation command.
| -rw-r--r-- | doc/ChangeLog | 6 | ||||
| -rw-r--r-- | doc/wget.texi | 23 | ||||
| -rw-r--r-- | src/ChangeLog | 5 | ||||
| -rw-r--r-- | src/init.c | 16 |
4 files changed, 39 insertions, 11 deletions
diff --git a/doc/ChangeLog b/doc/ChangeLog index dd43162..cbccee9 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,9 @@ +2014-09-08 Darshit Shah <darnir@gmail.com> + + * wget.texi (symbolic links): Update documentation of retr-symlinks to + reflect the new default. Add warning about potential security issues with + --retr-symlinks=yes. + 2014-10-16 Tim Ruehsen <tim.ruehsen@gmx.de> * wget.texi (Download Options): update --secure-protocol description diff --git a/doc/wget.texi b/doc/wget.texi index aef1f80..d7a4c94 100644 --- a/doc/wget.texi +++ b/doc/wget.texi @@ -1883,17 +1883,18 @@ Preserve remote file permissions instead of permissions set by umask. @cindex symbolic links, retrieving @item --retr-symlinks -Usually, when retrieving @sc{ftp} directories recursively and a symbolic -link is encountered, the linked-to file is not downloaded. Instead, a -matching symbolic link is created on the local filesystem. The -pointed-to file will not be downloaded unless this recursive retrieval -would have encountered it separately and downloaded it anyway. - -When @samp{--retr-symlinks} is specified, however, symbolic links are -traversed and the pointed-to files are retrieved. At this time, this -option does not cause Wget to traverse symlinks to directories and -recurse through them, but in the future it should be enhanced to do -this. +By default, when retrieving @sc{ftp} directories recursively and a symbolic link +is encountered, the symbolic link is traversed and the pointed-to files are +retrieved. Currently, Wget does not traverse symbolic links to directories to +download them recursively, though this feature may be added in the future. + +When @samp{--retr-symlinks=no} is specified, the linked-to file is not +downloaded. Instead, a matching symbolic link is created on the local +filesystem. The pointed-to file will not be retrieved unless this recursive +retrieval would have encountered it separately and downloaded it anyway. This +option poses a security risk where a malicious FTP Server may cause Wget to +write to files outside of the intended directories through a specially crafted +@sc{.listing} file. Note that when retrieving a file (not a directory) because it was specified on the command-line, rather than because it was recursed to, diff --git a/src/ChangeLog b/src/ChangeLog index c8a2f97..02c5134 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,8 @@ +2014-09-08 Darshit Shah <darnir@gmail.com> + + * init.c (defaults): Set retr-symlinks to true by default. This changes a + default setting of wget. Fixes security bug CVE-2014-4877 + 2014-10-08 Nikolay Morozov <n.morozov@securitycode.ru> Sergey Lvov <s.lvov@securitycode.ru> @@ -366,6 +366,22 @@ defaults (void) opt.dns_cache = true; opt.ftp_pasv = true; + /* 2014-09-07 Darshit Shah <darnir@gmail.com> + * opt.retr_symlinks is set to true by default. Creating symbolic links on the + * local filesystem pose a security threat by malicious FTP Servers that + * server a specially crafted .listing file akin to this: + * + * lrwxrwxrwx 1 root root 33 Dec 25 2012 JoCxl6d8rFU -> / + * drwxrwxr-x 15 1024 106 4096 Aug 28 02:02 JoCxl6d8rFU + * + * A .listing file in this fashion makes Wget susceptiple to a symlink attack + * wherein the attacker is able to create arbitrary files, directories and + * symbolic links on the target system and even set permissions. + * + * Hence, by default Wget attempts to retrieve the pointed-to files and does + * not create the symbolic links locally. + */ + opt.retr_symlinks = true; #ifdef HAVE_SSL opt.check_cert = true; |
