On Wed, Sep 9, 2015 at 2:52 AM, Andreas Stieger <astieger@suse.com> wrote:
> Hello,
>
> On 09/07/2015 10:39 PM, Austin English wrote:
>> This was reported to tails-dev [1] and other places [2] and is fixed
>> upstream [3].
>>
>> I've rebased the patch for 1.13.4 (attached), which is the current
>> version in Debian wheezy [4] that Tails is based on.
>>
>> Please keep me in CC, as I'm not subscribed.
>>
>> [1] https://mailman.boum.org/pipermail/tails-dev/2015-August/009370.html
>> [2] https://lists.gnu.org/archive/html/bug-wget/2015-08/msg00020.html
>> [3] http://git.savannah.gnu.org/cgit/wget.git/commit/?id=3D075d7556964f5=
a871a73c22ac4b69f5361295099
>> [4] https://packages.debian.org/wheezy/wget
>
> To reproduce:
>
> A $> nc -lv 8020
> B $> wget ftp://A:8020
>
> On A keep entering "200 ok", the following will be printed:
>
>> $ wget ftp://dexter:8020 > --2015-09-08 17:11:30-- ftp://dexter:8020/ > =
=3D>
> =E2=80=98.listing=E2=80=99 > Resolving dexter (dexter)... 10.160.4.160 > =
Connecting to
> dexter (dexter)|10.160.4.160|:8020... connected. > Logging in as
> anonymous ... Logged in! > =3D=3D> SYST ... done. =3D=3D> PWD ... done. >=
 =3D=3D>
> TYPE I ... done. =3D=3D> CWD not needed. > =3D=3D> PASV ... > Cannot pars=
e PASV
> response. > =3D=3D> PORT ...
>
> On the server side:
>
>> $ nc -lv 8020 > Connection from 10.160.4.160 port 8020 [tcp/intu-ec-svcd=
isc] accepted
>> 200 ok > USER anonymous > 200 ok > SYST > 200 ok > PWD > 200 ok > TYPE
> I > 200 ok > PASV > 200 ok > PORT 10,160,4,160,134,42
>        ^^^^^^^^^^^^
>
> This would affect IP users connecting through a privacy proxy or VPN,
> leaking their public IP address if they are otherwise connected without
> NAT. For users connecting without such a proxy but through NAT, it leaks
> the internal IP address.
>
> https://bugzilla.suse.com/show_bug.cgi?id=3D944858
>
> Andreas
>
> --
> Andreas Stieger <astieger@suse.com>
> Project Manager Security
> SUSE Linux GmbH, GF: Felix Imend=C3=B6rffer, Jane Smithard, Graham Norton=
, HRB 21284 (AG N=C3=BCrnberg)

Ping. It's been over two weeks, I was hoping to have a CVE for this by now =
:)

--=20
-Austin