bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
pacman/lib/libalpm
History
Andrew Gregory d197d8ab82 Sanitize file name received from Content-Disposition header 
When installing a remote package with "pacman -U <url>", pacman renames
the downloaded package file to match the name given in the
Content-Disposition header. However, pacman does not sanitize this name,
which may contain slashes, before calling rename(). A malicious server (or
a network MitM if downloading over HTTP) can send a content-disposition
header to make pacman place the file anywhere in the filesystem,
potentially leading to arbitrary root code execution. Notably, this
bypasses pacman's package signature checking.

For example, a malicious package-hosting server (or a network
man-in-the-middle, if downloading over HTTP) could serve the following
header:

Content-Disposition: filename=../../../../../../usr/share/libalpm/hooks/evil.hook

and pacman would move the downloaded file to
/usr/share/libalpm/hooks/evil.hook. This invocation of "pacman -U" would
later fail, unable to find the downloaded package in the cache directory,
but the hook file would remain in place. The commands in the malicious
hook would then be run (as root) the next time any package is installed.

Discovered-by: Adam Suhl <asuhl@mit.edu>
Signed-off-by: Allan McRae <allan@archlinux.org>
2019-03-01 11:23:20 +10:00
..
po Add meson.build files to build with meson 2018-11-02 03:16:34 -04:00
.gitignore libalpm: add pkg-config file 2012-04-25 20:02:36 -04:00
add.c libalpm/add.c: move assignment into conditional in alpm_add_pkg 2019-01-04 11:32:49 +10:00
add.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
alpm.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
alpm.h libalpm: fix minor typo in _alpm_db_usage_ 2019-01-21 13:47:23 +10:00
alpm_list.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
alpm_list.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
backup.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
backup.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
base64.c base64.c: comment out unused variable 2014-01-15 15:54:56 +10:00
base64.h Do not #define _RESERVED_IDENTIFIERS 2016-09-25 18:04:57 +10:00
be_local.c be_local.c: remove aligment in local_pkg_ops 2019-01-10 14:10:55 +10:00
be_package.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
be_sync.c libalpm: parse {check, make}depends when reading database 2019-01-10 14:04:59 +10:00
conflict.c Remove the last traces of the pacman --force option 2018-08-10 12:38:03 +10:00
conflict.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
db.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
db.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
delta.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
delta.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
deps.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
deps.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
diskspace.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
diskspace.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
dload.c Sanitize file name received from Content-Disposition header 2019-03-01 11:23:20 +10:00
dload.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
error.c add specific error for missing gpg support 2018-11-27 22:48:43 +10:00
filelist.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
filelist.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
graph.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
graph.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
group.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
group.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
handle.c silence warning when built without curl 2019-01-04 11:08:54 +10:00
handle.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
hook.c libalpm: ignore .hook suffix when sorting hooks 2018-08-10 12:37:19 +10:00
hook.h libalpm: ignore .hook suffix when sorting hooks 2018-08-10 12:37:19 +10:00
ini.c run hooks during trans_commit 2015-10-18 10:59:23 +10:00
ini.h run hooks during trans_commit 2015-10-18 10:59:23 +10:00
libalpm.pc.in libalpm.pc: migrate to Requires.private 2018-04-29 21:57:17 +10:00
libarchive-compat.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
log.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
log.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
Makefile.am Remove all modelines from the project 2018-05-14 09:59:15 +10:00
meson.build Add meson.build files to build with meson 2018-11-02 03:16:34 -04:00
package.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
package.h fix various typos 2019-02-04 10:17:30 +10:00
pkghash.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
pkghash.h Update coyrights for 2018 2018-03-14 13:31:31 +10:00
rawstr.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
remove.c Move skipping of duplicate sync/remove targets into libalpm 2019-01-04 11:31:55 +10:00
remove.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
signing.c fix various typos 2019-02-04 10:17:30 +10:00
signing.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
sync.c libalpm/sync.c: change alpm_sync_newversion() to alpm_sync_get_new_version() 2019-01-10 14:14:04 +10:00
sync.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
trans.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00
trans.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
util-common.c Split common utility functions for libalpm and pacman 2013-01-04 21:49:37 +10:00
util-common.h Split common utility functions for libalpm and pacman 2013-01-04 21:49:37 +10:00
util.c handle EINTR while polling scripts/hooks 2018-10-21 19:19:48 +10:00
util.h Remove all modelines from the project 2018-05-14 09:59:15 +10:00
version.c Remove all modelines from the project 2018-05-14 09:59:15 +10:00