From 5ee18666537e3086d399bc0f1e7d1849e64bd28f Mon Sep 17 00:00:00 2001 From: Lukas Zapletal Date: Fri, 6 Jun 2014 12:30:52 +0200 Subject: [PATCH] fixes #6086 - CVE-2014-0007: fixed TFTP boot API remote code execution --- lib/proxy/tftp.rb | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/lib/proxy/tftp.rb b/lib/proxy/tftp.rb index de9b79f..3219e6f 100644 --- a/lib/proxy/tftp.rb +++ b/lib/proxy/tftp.rb @@ -98,15 +98,17 @@ module Proxy::TFTP class << self include Proxy::Util def fetch_boot_file dst, src - filename = src.split("/")[-1] - destination = Pathname.new("#{SETTINGS.tftproot}/#{dst}-#{filename}") + filename = dst + '-' + src.split("/")[-1] + destination = Pathname.new(File.absolute_path(filename, SETTINGS.tftproot)).cleanpath + tftproot = Pathname.new(SETTINGS.tftproot).cleanpath + raise "TFTP destination outside of tftproot" unless destination.to_s.start_with?(tftproot.to_s) # Ensure that our image directory exists # as the dst might contain another sub directory FileUtils.mkdir_p destination.parent wget = which("wget") - cmd = "#{wget} --timeout=10 --tries=3 --no-check-certificate -nv -c #{src} -O \"#{destination}\"" + cmd = "#{wget} --timeout=10 --tries=3 --no-check-certificate -nv -c \"#{escape_for_shell(src)}\" -O \"#{escape_for_shell(destination)}\"" CommandTask.new(cmd) end end -- 1.9.3