bagder: curl-www/docs Makefile, 1.71, 1.72 _adv_20101013.html, NONE, 1.1 _security.html, 1.27, 1.28 adv_20101013.txt, NONE, 1.1 vuln.pm, 1.4, 1.5

Update of /cvsroot/curl/curl-www/docs
In directory giant.haxx.se:/var/tmp/cvs-serv26904

Modified Files:
	Makefile _security.html vuln.pm 
Added Files:
	_adv_20101013.html adv_20101013.txt 
Log Message:
adv_20101013 added


Index: _security.html
===================================================================
RCS file: /cvsroot/curl/curl-www/docs/_security.html,v
retrieving revision 1.27
retrieving revision 1.28
diff -u -d -r1.27 -r1.28
--- _security.html	29 Mar 2010 18:07:01 -0000	1.27
+++ _security.html	12 Oct 2010 21:14:38 -0000	1.28
@@ -38,6 +38,31 @@
  See also the <a href="vulnerabilities.html">Vulnerabilties Table</a> to see
  what versions that are vulnerable to what flaws.
 
+<a name="20101013"></a>
+SUBTITLE(curl local file overwrite)
+<p>
+<table class="secbox">
+  <tr><td>Date:</td><td>October 13, 2010</td></tr>
+  <tr><td>ID</td><td><small><a href="#20101013">(permalink)</a></small></td></tr>
+  <tr><td>Affected versions</td><td>7.20.0 to and including 7.21.1</td></tr>
+  <tr><td>Not affected versions</td><td>libcurl <= 7.20.0 and >= 7.21.2</td></tr>
+  <tr><td>Patch</td><td><a href="http://curl.haxx.se/curl-content-disposition.patch">curl-content-disposition.patch</a></td></tr>
+
+  <tr><td>Advisories</td><td>
+<a href="adv_20101013.html">Project cURL Security Advisory</a> </td></tr>
+
+</table>
+<p>
+  curl offers a command line option --remote-header-name (also usable as -J)
+  which will use the file name of the Content-disposition: header when it
+  saves the downloaded data locally.
+
+  curl attempts to cut off the directory parts from any given file name in the
+  header to only store files in the current directory. It will overwrite a
+  local file using the same name as the header specifies.
+
+  The stripping of the directory did not take backslashes into account.
+
 <a name="20100209"></a>
 SUBTITLE(libcurl data callback excessive length)
 <p>

--- NEW FILE: adv_20101013.txt ---
                           curl local file overwrite
                           =========================

Project cURL Security Advisory, October 13th 2010
http://curl.haxx.se/docs/security.html

1. VULNERABILITY

  curl offers a command line option --remote-header-name (also usable as -J)
  which will use the file name of the Content-disposition: header when it
  saves the downloaded data locally.

  curl attempts to cut off the directory parts from any given file name in the
  header to only store files in the current directory. It will overwrite a
  local file using the same name as the header specifies.

  The stripping of the directory did not take backslashes into account. On
  some operating systems, backslashes are used to separate directories and
  file names. This allows a rogue server to send back a response that
  overwrites a file name in the local machine that the user is allowed to
  write, potentially a system file, a command or a known executable.

  Operating systems affected include Windows, Netware, MSDOS, OS/2 and
  Symbian.

  This error is only present in the curl command line tool, it is NOT a
  problem of the library libcurl.

  There is no known exploit for this problem.

2. AFFECTED VERSIONS

  Affected versions: curl 7.20.0 to and including 7.21.1
  Not affected versions: curl < 7.20.0 and >= 7.21.2

  Also note that curl is used by many applications, and not always advertised
  as such.

3. THE SOLUTION

  libcurl 7.21.2 makes sure that it will also strip off paths specified using
  backslashes as path separator.

4. RECOMMENDATIONS

  We suggest you take one of the following actions immediately, in order of
  preference:

  A - Upgrade to curl and libcurl 7.21.2

  B - Apply this patch and rebuild

      http://curl.haxx.se/curl-content-disposition.patch

  C - Stop using the --remote-header-name/-J option

5. TIME LINE

  Dan Fandrich realized the problem exists and reported to the rest of the
  team on September 3 2010.

  We discussed solutions and a first patch was written and tested on September
  4th.

  curl 7.21.2 was released on October 13th 2010, just before this flaw was
  publicly disclosed.

6. CREDITS

  Reported to us by Dan Fandrich. Thanks a lot!

  Daniel Stenberg wrote the primary patch and this advisory

Index: vuln.pm
===================================================================
RCS file: /cvsroot/curl/curl-www/docs/vuln.pm,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -d -r1.4 -r1.5
--- vuln.pm	9 Feb 2010 09:30:34 -0000	1.4
+++ vuln.pm	12 Oct 2010 21:14:39 -0000	1.5
@@ -1,5 +1,6 @@
 # datestamp, first vulnerable version, last vulnerable version
 @vuln = (
+    "20101013|7.20.0|7.21.1|curl local file overwrite",
     "20100209|7.10.5|7.19.7|libcurl data callback excessive length",
     "20090812|7.4   |7.19.5|libcurl embedded zero in cert name",
     "20090303|5.11  |7.19.3|libcurl Arbitrary File Access",

Index: Makefile
===================================================================
RCS file: /cvsroot/curl/curl-www/docs/Makefile,v
retrieving revision 1.71
retrieving revision 1.72
diff -u -d -r1.71 -r1.72
--- Makefile	9 Oct 2010 10:16:59 -0000	1.71
+++ Makefile	12 Oct 2010 21:14:38 -0000	1.72
@@ -21,7 +21,7 @@
  libs.html adv_20051013.html adv_20051207.html \
  adv_20060320.html vulnerabilities.html adv_20070710.html \
  gsoc2008.html releases.html adv_20090303.html releases.csv adv_20090812.html \
- adv_20100209.html
+ adv_20100209.html adv_20101013.html
 
 all: $(PAGES)
 	@echo done 
@@ -222,6 +222,12 @@
 adv_20100209.t: adv_20100209.txt
 	$(TXT2PLAIN) < $< > $@
 
+adv_20101013.html: _adv_20101013.html adv_20101013.t $(MAINPARTS)
+	$(ACTION)
+
+adv_20101013.t: adv_20101013.txt
+	$(TXT2PLAIN) < $< > $@
+
 vulnerabilities.html: _vulnerabilities.html vuln.txt $(MAINPARTS)
 	$(ACTION)
 

--- NEW FILE: _adv_20101013.html ---
#include "_doctype.html"
<HTML>
<HEAD> <TITLE>cURL - Security Advisory (February 9, 2010)</TITLE>
#include "css.t"
#include "manpage.t"
</HEAD>

#define CURL_DOCS
#define CURL_URL docs/adv_20101013.html

#include "_menu.html"
#include "setup.t"

WHERE3(Docs, "/docs/", Security, "/docs/security.html",
 Security Advisory October 13 2010)

TITLE(Security Advisory October 13 2010)
<div class="relatedbox">
<b>Related:</b>
<br><a href="manual.html">Manual</a>
<br><a href="faq.html">FAQ</a>
<br><a href="/changes.html">Changelog</a>
<br><a href="http://www.gnu.org/software/gnutls/security.html">GnuTLS sec</a>
</div>

<pre>
#include "adv_20101013.t"
</pre>

#include "_footer.html"
</body> </html>