Das bekannte Toolset cURL, enthält eine Sicherheitslücke, mit der es möglich ist Dateien lokal auszulesen. Die Entwickler äussern sich dazu folgendermassen:
The problem can also be exploited for uploading, if the rogue server
redirects the client to a local file and thus it would (over)write a local
file instead of sending it to the server.
libcurl compiled to support SCP can get tricked to get a file using embedded
semicolons, which can lead to execution of commands on the given
server. "Location: scp://name:passwd@host/a'``;date >/tmp/test``;'".
Files on servers other than the one running libcurl are also accessible when
credentials for those servers are stored in the .netrc file of the user
running libcurl. This is most common for FTP servers, but can occur with
any protocol supported by libcurl. Files on remote SSH servers are also
accessible when the user has an unencrypted SSH key.
Affected versions: curl and libcurl 5.11(!) to and including 7.19.3
Not affected versions: curl and libcurl 5.10 and earlier, 7.19.4 and later
