Insecure HTTP download of preseed file by installer

[msteinmann]

The official Debian installer ISO of 3CX v20 downloads a Debian installer preseed file via unencrypted HTTP from
http://downloads-global.3cx.com/downloads/debian12iso/preseed_12.1.0_46a7ea2.txt

• This is configured as a boot parameter for the ISO via the "url=" parameter
• Download is unencrypted
• The preseed file is not otherwise integrity protected (signature etc.)
• Any adversary with control of the network path or the DNS can change the contents of the seed file in transfer and by that gain code execution during the installation, since the seed file allows to define arbitrary commands to be executed during installation

The download of the preseed file should be done via HTTPS and certificates should be verified for that connection.

 

[nikolascx]

Hi msteinmann
Seems fixed already. Can you check again?
From my tests I also see url redirection configured from http to https.
Thanks for reporting. At your disposal for anything you need.

 

[msteinmann]

Hi msteinmann
Seems fixed already. Can you check again?
From my tests I also see url redirection configured from http to https.
Thanks for reporting. At your disposal for anything you need.

Thanks for the fast response.

I redownloaded the current ISO and it is still specifying to download the preseed file from HTTP, see for example

boot/grub/grub.cfg:    linux    /install.amd/vmlinuz vga=788 ipv6.disable=1 auto=true priority=high url=http://downloads-global.3cx.com/downloads/debian10iso/preseed_10.11.0_780023f.txt --- quiet THREECXMARKER=DEBIAN-3CX-ISO

The target server responding with a http-to-https redirect is not a sufficient security measure. If an adversary controls the network path or DNS he can already respond to the first HTTP-request with a malicious preseed file.

 

[nikolascx]

Seems I was checking wrong. You are correct.
We will upload another iso tomorrow. Thanks for reporting. At your disposal for anything you need.