514184 – (CVE-2014-4510) <net-misc/apt-cacher-ng-0.7.26-r1: XSS vulnerability in apt-cacher-ng (CVE-2014-4510)

Bug 514184 (CVE-2014-4510) - <net-misc/apt-cacher-ng-0.7.26-r1: XSS vulnerability in apt-cacher-ng (CVE-2014-4510)

Summary: <net-misc/apt-cacher-ng-0.7.26-r1: XSS vulnerability in apt-cacher-ng (CVE-20...

Status:	RESOLVED FIXED

Alias:	CVE-2014-4510

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial (vote)
Assignee:	Gentoo Security

URL:	http://seclists.org/oss-sec/2014/q2/602
Whiteboard:	~4 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2014-06-21 16:23 UTC by Kristian Fiskerstrand (RETIRED)
Modified:	2014-06-26 05:19 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Kristian Fiskerstrand (RETIRED) gentoo-dev

2014-06-21 16:23:49 UTC

From ${URL}:
I am sorry to report that one of my packages (with upstream hat on) has
an XSS attack vulnerability. The way for the attacker to exploit this is
to redirect the user's browser in a LAN to apt-cacher-ng server (which
address the attacker has to know) with a manipulated URL. Since the
location and TCP port of the cacher server are configurable, it's IMHO
not totally easy to find but is still a good attack vector with insider
knowledge.

Here is the proposed fix:
http://anonscm.debian.org/gitweb/?p=apt-cacher-ng/apt-cacher-ng.git;a=commitdiff;h=6f08e6a3995d1bed4e837889a3945b6dc650f6ad

Comment 1 Agostino Sarubbo gentoo-dev

2014-06-21 16:32:31 UTC

Do we have an upstream version that address this issue?

Comment 2 Kristian Fiskerstrand (RETIRED) gentoo-dev

2014-06-21 16:45:28 UTC

(In reply to Agostino Sarubbo from comment #1)
> Do we have an upstream version that address this issue?

I've only seen the upstream patch in git so far, no released upstream version.

Comment 3 Agostino Sarubbo gentoo-dev

2014-06-21 17:04:03 UTC

(In reply to Kristian Fiskerstrand from comment #2)
> (In reply to Agostino Sarubbo from comment #1)
> > Do we have an upstream version that address this issue?
> 
> I've only seen the upstream patch in git so far, no released upstream
> version.

so in such case, the tag is upstream/ebuild

Comment 4 Jeroen Roovers (RETIRED) gentoo-dev

2014-06-24 13:21:17 UTC

Patch added in -r1.

Comment 5 Kristian Fiskerstrand (RETIRED) gentoo-dev

2014-06-24 13:26:26 UTC

Thank you jer. 

As this package has not been stabilized it does not need a stabilization or a glsa, however could you please remove any vulnerable packages from the tree? (it might have been done already, however I don't see any update to the anon cvs at this time).

Comment 6 Jeroen Roovers (RETIRED) gentoo-dev

2014-06-24 13:30:49 UTC

*apt-cacher-ng-0.7.26-r1 (24 Jun 2014)
 
  24 Jun 2014; Jeroen Roovers <jer@gentoo.org> -apt-cacher-ng-0.7.26.ebuild,
  +apt-cacher-ng-0.7.26-r1.ebuild,
  +files/apt-cacher-ng-0.7.26-CVE-2014-4510.patch:
  Add patch for CVE-2014-4510 (bug #514184).

The old ebuild is gone.

Comment 7 Kristian Fiskerstrand (RETIRED) gentoo-dev

2014-06-24 13:31:39 UTC

Perfect, thanks.