Mageia Bugzilla – Attachment 8061 Details for
Bug 18671
wget new security issues CVE-2016-4971 and CVE-2016-7098
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
Log In
[x]
|
New Account
|
Forgot Password
[patch]
Patch from Ubuntu for wget 1.15
CVE-2016-4971.patch (text/plain), 10.61 KB, created by
Philippe Makowski
on 2016-06-24 01:10:14 CEST
(
hide
)
Description:
Patch from Ubuntu for wget 1.15
Filename:
MIME Type:
Creator:
Philippe Makowski
Created:
2016-06-24 01:10:14 CEST
Size:
10.61 KB
patch
obsolete
>Backported from: > >From e996e322ffd42aaa051602da182d03178d0f13e1 Mon Sep 17 00:00:00 2001 >From: Giuseppe Scrivano <gscrivan@redhat.com> >Date: Mon, 06 Jun 2016 19:20:24 +0000 >Subject: ftp: understand --trust-server-names on a HTTP->FTP redirect > >If not --trust-server-names is used, FTP will also get the destination >file name from the original url specified by the user instead of the >redirected url. Closes CVE-2016-4971. > >* src/ftp.c (ftp_get_listing): Add argument original_url. >(getftp): Likewise. >(ftp_loop_internal): Likewise. Use original_url to generate the >file name if --trust-server-names is not provided. >(ftp_retrieve_glob): Likewise. >(ftp_loop): Likewise. > >Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> >--- >Index: wget-1.15/src/ftp.c >=================================================================== >--- wget-1.15.orig/src/ftp.c 2016-06-14 10:46:50.309326193 +0300 >+++ wget-1.15/src/ftp.c 2016-06-14 10:49:24.834606049 +0300 >@@ -235,14 +235,15 @@ > logputs (LOG_VERBOSE, !authoritative ? _(" (unauthoritative)\n") : "\n"); > } > >-static uerr_t ftp_get_listing (struct url *, ccon *, struct fileinfo **); >+static uerr_t ftp_get_listing (struct url *, struct url *, ccon *, struct fileinfo **); > > /* Retrieves a file with denoted parameters through opening an FTP > connection to the server. It always closes the data connection, > and closes the control connection in case of error. If warc_tmp > is non-NULL, the downloaded data will be written there as well. */ > static uerr_t >-getftp (struct url *u, wgint passed_expected_bytes, wgint *qtyread, >+getftp (struct url *u, struct url *original_url, >+ wgint passed_expected_bytes, wgint *qtyread, > wgint restval, ccon *con, int count, FILE *warc_tmp) > { > int csock, dtsock, local_sock, res; >@@ -988,7 +989,7 @@ > bool exists = false; > uerr_t res; > struct fileinfo *f; >- res = ftp_get_listing (u, con, &f); >+ res = ftp_get_listing (u, original_url, con, &f); > /* Set the DO_RETR command flag again, because it gets unset when > calling ftp_get_listing() and would otherwise cause an assertion > failure earlier on when this function gets repeatedly called >@@ -1532,7 +1533,8 @@ > This loop either gets commands from con, or (if ON_YOUR_OWN is > set), makes them up to retrieve the file given by the URL. */ > static uerr_t >-ftp_loop_internal (struct url *u, struct fileinfo *f, ccon *con, char **local_file) >+ftp_loop_internal (struct url *u, struct url *original_url, struct fileinfo *f, >+ ccon *con, char **local_file) > { > int count, orig_lp; > wgint restval, len = 0, qtyread = 0; >@@ -1555,7 +1557,7 @@ > else > { > /* URL-derived file. Consider "-O file" name. */ >- con->target = url_file_name (u, NULL); >+ con->target = url_file_name (opt.trustservernames || !original_url ? u : original_url, NULL); > if (!opt.output_document) > locf = con->target; > else >@@ -1669,7 +1671,8 @@ > > /* If we are working on a WARC record, getftp should also write > to the warc_tmp file. */ >- err = getftp (u, len, &qtyread, restval, con, count, warc_tmp); >+ err = getftp (u, original_url, len, &qtyread, restval, con, count, >+ warc_tmp); > > if (con->csock == -1) > con->st &= ~DONE_CWD; >@@ -1822,7 +1825,8 @@ > /* Return the directory listing in a reusable format. The directory > is specifed in u->dir. */ > static uerr_t >-ftp_get_listing (struct url *u, ccon *con, struct fileinfo **f) >+ftp_get_listing (struct url *u, struct url *original_url, ccon *con, >+ struct fileinfo **f) > { > uerr_t err; > char *uf; /* url file name */ >@@ -1843,7 +1847,7 @@ > > con->target = xstrdup (lf); > xfree (lf); >- err = ftp_loop_internal (u, NULL, con, NULL); >+ err = ftp_loop_internal (u, original_url, NULL, con, NULL); > lf = xstrdup (con->target); > xfree (con->target); > con->target = old_target; >@@ -1866,8 +1870,9 @@ > return err; > } > >-static uerr_t ftp_retrieve_dirs (struct url *, struct fileinfo *, ccon *); >-static uerr_t ftp_retrieve_glob (struct url *, ccon *, int); >+static uerr_t ftp_retrieve_dirs (struct url *, struct url *, >+ struct fileinfo *, ccon *); >+static uerr_t ftp_retrieve_glob (struct url *, struct url *, ccon *, int); > static struct fileinfo *delelement (struct fileinfo *, struct fileinfo **); > static void freefileinfo (struct fileinfo *f); > >@@ -1879,7 +1884,8 @@ > If opt.recursive is set, after all files have been retrieved, > ftp_retrieve_dirs will be called to retrieve the directories. */ > static uerr_t >-ftp_retrieve_list (struct url *u, struct fileinfo *f, ccon *con) >+ftp_retrieve_list (struct url *u, struct url *original_url, >+ struct fileinfo *f, ccon *con) > { > static int depth = 0; > uerr_t err; >@@ -2038,7 +2044,7 @@ > else /* opt.retr_symlinks */ > { > if (dlthis) >- err = ftp_loop_internal (u, f, con, NULL); >+ err = ftp_loop_internal (u, original_url, f, con, NULL); > } /* opt.retr_symlinks */ > break; > case FT_DIRECTORY: >@@ -2049,7 +2055,7 @@ > case FT_PLAINFILE: > /* Call the retrieve loop. */ > if (dlthis) >- err = ftp_loop_internal (u, f, con, NULL); >+ err = ftp_loop_internal (u, original_url, f, con, NULL); > break; > case FT_UNKNOWN: > logprintf (LOG_NOTQUIET, _("%s: unknown/unsupported file type.\n"), >@@ -2114,7 +2120,7 @@ > /* We do not want to call ftp_retrieve_dirs here */ > if (opt.recursive && > !(opt.reclevel != INFINITE_RECURSION && depth >= opt.reclevel)) >- err = ftp_retrieve_dirs (u, orig, con); >+ err = ftp_retrieve_dirs (u, original_url, orig, con); > else if (opt.recursive) > DEBUGP ((_("Will not retrieve dirs since depth is %d (max %d).\n"), > depth, opt.reclevel)); >@@ -2127,7 +2133,8 @@ > ftp_retrieve_glob on each directory entry. The function knows > about excluded directories. */ > static uerr_t >-ftp_retrieve_dirs (struct url *u, struct fileinfo *f, ccon *con) >+ftp_retrieve_dirs (struct url *u, struct url *original_url, >+ struct fileinfo *f, ccon *con) > { > char *container = NULL; > int container_size = 0; >@@ -2177,7 +2184,7 @@ > odir = xstrdup (u->dir); /* because url_set_dir will free > u->dir. */ > url_set_dir (u, newdir); >- ftp_retrieve_glob (u, con, GLOB_GETALL); >+ ftp_retrieve_glob (u, original_url, con, GLOB_GETALL); > url_set_dir (u, odir); > xfree (odir); > >@@ -2236,14 +2243,15 @@ > GLOB_GLOBALL, use globbing; if it's GLOB_GETALL, download the whole > directory. */ > static uerr_t >-ftp_retrieve_glob (struct url *u, ccon *con, int action) >+ftp_retrieve_glob (struct url *u, struct url *original_url, >+ ccon *con, int action) > { > struct fileinfo *f, *start; > uerr_t res; > > con->cmd |= LEAVE_PENDING; > >- res = ftp_get_listing (u, con, &start); >+ res = ftp_get_listing (u, original_url, con, &start); > if (res != RETROK) > return res; > /* First: weed out that do not conform the global rules given in >@@ -2339,7 +2347,7 @@ > if (start) > { > /* Just get everything. */ >- res = ftp_retrieve_list (u, start, con); >+ res = ftp_retrieve_list (u, original_url, start, con); > } > else > { >@@ -2355,7 +2363,7 @@ > { > /* Let's try retrieving it anyway. */ > con->st |= ON_YOUR_OWN; >- res = ftp_loop_internal (u, NULL, con, NULL); >+ res = ftp_loop_internal (u, original_url, NULL, con, NULL); > return res; > } > >@@ -2375,8 +2383,8 @@ > of URL. Inherently, its capabilities are limited on what can be > encoded into a URL. */ > uerr_t >-ftp_loop (struct url *u, char **local_file, int *dt, struct url *proxy, >- bool recursive, bool glob) >+ftp_loop (struct url *u, struct url *original_url, char **local_file, int *dt, >+ struct url *proxy, bool recursive, bool glob) > { > ccon con; /* FTP connection */ > uerr_t res; >@@ -2397,16 +2405,17 @@ > if (!*u->file && !recursive) > { > struct fileinfo *f; >- res = ftp_get_listing (u, &con, &f); >+ res = ftp_get_listing (u, original_url, &con, &f); > > if (res == RETROK) > { > if (opt.htmlify && !opt.spider) > { >+ struct url *url_file = opt.trustservernames ? u : original_url; > char *filename = (opt.output_document > ? xstrdup (opt.output_document) > : (con.target ? xstrdup (con.target) >- : url_file_name (u, NULL))); >+ : url_file_name (url_file, NULL))); > res = ftp_index (filename, u, f); > if (res == FTPOK && opt.verbose) > { >@@ -2451,11 +2460,11 @@ > /* ftp_retrieve_glob is a catch-all function that gets called > if we need globbing, time-stamping, recursion or preserve > permissions. Its third argument is just what we really need. */ >- res = ftp_retrieve_glob (u, &con, >+ res = ftp_retrieve_glob (u, original_url, &con, > ispattern ? GLOB_GLOBALL : GLOB_GETONE); > } > else >- res = ftp_loop_internal (u, NULL, &con, local_file); >+ res = ftp_loop_internal (u, original_url, NULL, &con, local_file); > } > if (res == FTPOK) > res = RETROK; >Index: wget-1.15/src/ftp.h >=================================================================== >--- wget-1.15.orig/src/ftp.h 2016-06-14 10:46:50.309326193 +0300 >+++ wget-1.15/src/ftp.h 2016-06-14 10:46:50.305326162 +0300 >@@ -152,7 +152,8 @@ > }; > > struct fileinfo *ftp_parse_ls (const char *, const enum stype); >-uerr_t ftp_loop (struct url *, char **, int *, struct url *, bool, bool); >+uerr_t ftp_loop (struct url *, struct url *, char **, int *, struct url *, >+ bool, bool); > > uerr_t ftp_index (const char *, struct url *, struct fileinfo *); > >Index: wget-1.15/src/retr.c >=================================================================== >--- wget-1.15.orig/src/retr.c 2016-06-14 10:46:50.309326193 +0300 >+++ wget-1.15/src/retr.c 2016-06-14 10:46:50.305326162 +0300 >@@ -801,7 +801,8 @@ > if (redirection_count) > oldrec = glob = false; > >- result = ftp_loop (u, &local_file, dt, proxy_url, recursive, glob); >+ result = ftp_loop (u, orig_parsed, &local_file, dt, proxy_url, >+ recursive, glob); > recursive = oldrec; > > /* There is a possibility of having HTTP being redirected to
Backported from: From e996e322ffd42aaa051602da182d03178d0f13e1 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano <gscrivan@redhat.com> Date: Mon, 06 Jun 2016 19:20:24 +0000 Subject: ftp: understand --trust-server-names on a HTTP->FTP redirect If not --trust-server-names is used, FTP will also get the destination file name from the original url specified by the user instead of the redirected url. Closes CVE-2016-4971. * src/ftp.c (ftp_get_listing): Add argument original_url. (getftp): Likewise. (ftp_loop_internal): Likewise. Use original_url to generate the file name if --trust-server-names is not provided. (ftp_retrieve_glob): Likewise. (ftp_loop): Likewise. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> --- Index: wget-1.15/src/ftp.c =================================================================== --- wget-1.15.orig/src/ftp.c 2016-06-14 10:46:50.309326193 +0300 +++ wget-1.15/src/ftp.c 2016-06-14 10:49:24.834606049 +0300 @@ -235,14 +235,15 @@ logputs (LOG_VERBOSE, !authoritative ? _(" (unauthoritative)\n") : "\n"); } -static uerr_t ftp_get_listing (struct url *, ccon *, struct fileinfo **); +static uerr_t ftp_get_listing (struct url *, struct url *, ccon *, struct fileinfo **); /* Retrieves a file with denoted parameters through opening an FTP connection to the server. It always closes the data connection, and closes the control connection in case of error. If warc_tmp is non-NULL, the downloaded data will be written there as well. */ static uerr_t -getftp (struct url *u, wgint passed_expected_bytes, wgint *qtyread, +getftp (struct url *u, struct url *original_url, + wgint passed_expected_bytes, wgint *qtyread, wgint restval, ccon *con, int count, FILE *warc_tmp) { int csock, dtsock, local_sock, res; @@ -988,7 +989,7 @@ bool exists = false; uerr_t res; struct fileinfo *f; - res = ftp_get_listing (u, con, &f); + res = ftp_get_listing (u, original_url, con, &f); /* Set the DO_RETR command flag again, because it gets unset when calling ftp_get_listing() and would otherwise cause an assertion failure earlier on when this function gets repeatedly called @@ -1532,7 +1533,8 @@ This loop either gets commands from con, or (if ON_YOUR_OWN is set), makes them up to retrieve the file given by the URL. */ static uerr_t -ftp_loop_internal (struct url *u, struct fileinfo *f, ccon *con, char **local_file) +ftp_loop_internal (struct url *u, struct url *original_url, struct fileinfo *f, + ccon *con, char **local_file) { int count, orig_lp; wgint restval, len = 0, qtyread = 0; @@ -1555,7 +1557,7 @@ else { /* URL-derived file. Consider "-O file" name. */ - con->target = url_file_name (u, NULL); + con->target = url_file_name (opt.trustservernames || !original_url ? u : original_url, NULL); if (!opt.output_document) locf = con->target; else @@ -1669,7 +1671,8 @@ /* If we are working on a WARC record, getftp should also write to the warc_tmp file. */ - err = getftp (u, len, &qtyread, restval, con, count, warc_tmp); + err = getftp (u, original_url, len, &qtyread, restval, con, count, + warc_tmp); if (con->csock == -1) con->st &= ~DONE_CWD; @@ -1822,7 +1825,8 @@ /* Return the directory listing in a reusable format. The directory is specifed in u->dir. */ static uerr_t -ftp_get_listing (struct url *u, ccon *con, struct fileinfo **f) +ftp_get_listing (struct url *u, struct url *original_url, ccon *con, + struct fileinfo **f) { uerr_t err; char *uf; /* url file name */ @@ -1843,7 +1847,7 @@ con->target = xstrdup (lf); xfree (lf); - err = ftp_loop_internal (u, NULL, con, NULL); + err = ftp_loop_internal (u, original_url, NULL, con, NULL); lf = xstrdup (con->target); xfree (con->target); con->target = old_target; @@ -1866,8 +1870,9 @@ return err; } -static uerr_t ftp_retrieve_dirs (struct url *, struct fileinfo *, ccon *); -static uerr_t ftp_retrieve_glob (struct url *, ccon *, int); +static uerr_t ftp_retrieve_dirs (struct url *, struct url *, + struct fileinfo *, ccon *); +static uerr_t ftp_retrieve_glob (struct url *, struct url *, ccon *, int); static struct fileinfo *delelement (struct fileinfo *, struct fileinfo **); static void freefileinfo (struct fileinfo *f); @@ -1879,7 +1884,8 @@ If opt.recursive is set, after all files have been retrieved, ftp_retrieve_dirs will be called to retrieve the directories. */ static uerr_t -ftp_retrieve_list (struct url *u, struct fileinfo *f, ccon *con) +ftp_retrieve_list (struct url *u, struct url *original_url, + struct fileinfo *f, ccon *con) { static int depth = 0; uerr_t err; @@ -2038,7 +2044,7 @@ else /* opt.retr_symlinks */ { if (dlthis) - err = ftp_loop_internal (u, f, con, NULL); + err = ftp_loop_internal (u, original_url, f, con, NULL); } /* opt.retr_symlinks */ break; case FT_DIRECTORY: @@ -2049,7 +2055,7 @@ case FT_PLAINFILE: /* Call the retrieve loop. */ if (dlthis) - err = ftp_loop_internal (u, f, con, NULL); + err = ftp_loop_internal (u, original_url, f, con, NULL); break; case FT_UNKNOWN: logprintf (LOG_NOTQUIET, _("%s: unknown/unsupported file type.\n"), @@ -2114,7 +2120,7 @@ /* We do not want to call ftp_retrieve_dirs here */ if (opt.recursive && !(opt.reclevel != INFINITE_RECURSION && depth >= opt.reclevel)) - err = ftp_retrieve_dirs (u, orig, con); + err = ftp_retrieve_dirs (u, original_url, orig, con); else if (opt.recursive) DEBUGP ((_("Will not retrieve dirs since depth is %d (max %d).\n"), depth, opt.reclevel)); @@ -2127,7 +2133,8 @@ ftp_retrieve_glob on each directory entry. The function knows about excluded directories. */ static uerr_t -ftp_retrieve_dirs (struct url *u, struct fileinfo *f, ccon *con) +ftp_retrieve_dirs (struct url *u, struct url *original_url, + struct fileinfo *f, ccon *con) { char *container = NULL; int container_size = 0; @@ -2177,7 +2184,7 @@ odir = xstrdup (u->dir); /* because url_set_dir will free u->dir. */ url_set_dir (u, newdir); - ftp_retrieve_glob (u, con, GLOB_GETALL); + ftp_retrieve_glob (u, original_url, con, GLOB_GETALL); url_set_dir (u, odir); xfree (odir); @@ -2236,14 +2243,15 @@ GLOB_GLOBALL, use globbing; if it's GLOB_GETALL, download the whole directory. */ static uerr_t -ftp_retrieve_glob (struct url *u, ccon *con, int action) +ftp_retrieve_glob (struct url *u, struct url *original_url, + ccon *con, int action) { struct fileinfo *f, *start; uerr_t res; con->cmd |= LEAVE_PENDING; - res = ftp_get_listing (u, con, &start); + res = ftp_get_listing (u, original_url, con, &start); if (res != RETROK) return res; /* First: weed out that do not conform the global rules given in @@ -2339,7 +2347,7 @@ if (start) { /* Just get everything. */ - res = ftp_retrieve_list (u, start, con); + res = ftp_retrieve_list (u, original_url, start, con); } else { @@ -2355,7 +2363,7 @@ { /* Let's try retrieving it anyway. */ con->st |= ON_YOUR_OWN; - res = ftp_loop_internal (u, NULL, con, NULL); + res = ftp_loop_internal (u, original_url, NULL, con, NULL); return res; } @@ -2375,8 +2383,8 @@ of URL. Inherently, its capabilities are limited on what can be encoded into a URL. */ uerr_t -ftp_loop (struct url *u, char **local_file, int *dt, struct url *proxy, - bool recursive, bool glob) +ftp_loop (struct url *u, struct url *original_url, char **local_file, int *dt, + struct url *proxy, bool recursive, bool glob) { ccon con; /* FTP connection */ uerr_t res; @@ -2397,16 +2405,17 @@ if (!*u->file && !recursive) { struct fileinfo *f; - res = ftp_get_listing (u, &con, &f); + res = ftp_get_listing (u, original_url, &con, &f); if (res == RETROK) { if (opt.htmlify && !opt.spider) { + struct url *url_file = opt.trustservernames ? u : original_url; char *filename = (opt.output_document ? xstrdup (opt.output_document) : (con.target ? xstrdup (con.target) - : url_file_name (u, NULL))); + : url_file_name (url_file, NULL))); res = ftp_index (filename, u, f); if (res == FTPOK && opt.verbose) { @@ -2451,11 +2460,11 @@ /* ftp_retrieve_glob is a catch-all function that gets called if we need globbing, time-stamping, recursion or preserve permissions. Its third argument is just what we really need. */ - res = ftp_retrieve_glob (u, &con, + res = ftp_retrieve_glob (u, original_url, &con, ispattern ? GLOB_GLOBALL : GLOB_GETONE); } else - res = ftp_loop_internal (u, NULL, &con, local_file); + res = ftp_loop_internal (u, original_url, NULL, &con, local_file); } if (res == FTPOK) res = RETROK; Index: wget-1.15/src/ftp.h =================================================================== --- wget-1.15.orig/src/ftp.h 2016-06-14 10:46:50.309326193 +0300 +++ wget-1.15/src/ftp.h 2016-06-14 10:46:50.305326162 +0300 @@ -152,7 +152,8 @@ }; struct fileinfo *ftp_parse_ls (const char *, const enum stype); -uerr_t ftp_loop (struct url *, char **, int *, struct url *, bool, bool); +uerr_t ftp_loop (struct url *, struct url *, char **, int *, struct url *, + bool, bool); uerr_t ftp_index (const char *, struct url *, struct fileinfo *); Index: wget-1.15/src/retr.c =================================================================== --- wget-1.15.orig/src/retr.c 2016-06-14 10:46:50.309326193 +0300 +++ wget-1.15/src/retr.c 2016-06-14 10:46:50.305326162 +0300 @@ -801,7 +801,8 @@ if (redirection_count) oldrec = glob = false; - result = ftp_loop (u, &local_file, dt, proxy_url, recursive, glob); + result = ftp_loop (u, orig_parsed, &local_file, dt, proxy_url, + recursive, glob); recursive = oldrec; /* There is a possibility of having HTTP being redirected to
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 18671
: 8061