mirror of
https://github.com/pbatard/rufus.git
synced 2026-11-13 16:53:58 +00:00
d1b9f871ff* Because Rock Ridge symlinks can state whatever they want as their target, and we did not validate it, an attacker could create a malicious ISO-9660 + Rock Ridge ISO with something like a /link/ symlink that points to a directory that does not reside on the target drive (such as C:\Windows\). * Then if that same ISO also contains orphaned files in the /link/ directory, these files would be unconditionally extracted under the symlink target, thereby allowing the malicious ISO creator to drop arbitrary content on a user's system drive. * Prevent this by validating that the symlink cannot include a drive qualifier, by testing for ':' as well as anything that starts with '\' or contains '?' (for '\\?\...' or '\\.\...' or '\\server\share\' paths that would break containment). * Also make sure that we use CREATE_NEW instead of CREATE_ALWAYS when calling CreatePreallocatedFile(), since we should have just formatted the target drive anyway, and this can mitigate the overwriting of system files if another similar vulnerability is uncovered. * Also add provision for validating that the file created by CreatePreallocatedFile() does resides on our intended target drive. Currently, this is only enabled for MSVC/DEBUG, as it's a bit too late in the release cycle to properly validate such a change and we expect the mitigation above to fully have addressed the vulnerability, but we do plan to make it unconditional for the next release. * Addresses https://github.com/pbatard/rufus/security/advisories/GHSA-w4w7-p3x2-3p83. |
||
|---|---|---|
| .. | ||
| bled.vcxproj | ||
| bled.vcxproj.filters | ||
| ext2fs.vcxproj | ||
| ext2fs.vcxproj.filters | ||
| Generate.PDB.props | ||
| getopt.vcxproj | ||
| getopt.vcxproj.filters | ||
| libcdio-driver.vcxproj | ||
| libcdio-driver.vcxproj.filters | ||
| libcdio-iso9660.vcxproj | ||
| libcdio-iso9660.vcxproj.filters | ||
| libcdio-udf.vcxproj | ||
| libcdio-udf.vcxproj.filters | ||
| ms-sys.vcxproj | ||
| ms-sys.vcxproj.filters | ||
| rufus.vcxproj | ||
| rufus.vcxproj.filters | ||
| syslinux-libfat.vcxproj | ||
| syslinux-libfat.vcxproj.filters | ||
| syslinux-libinstaller.vcxproj | ||
| syslinux-libinstaller.vcxproj.filters | ||
| syslinux-win.vcxproj | ||
| syslinux-win.vcxproj.filters | ||
| wimlib.vcxproj | ||
| wimlib.vcxproj.filters | ||