[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140909083435.GA9815@steve.org.uk>
Date: Tue, 9 Sep 2014 09:34:35 +0100
From: Steve Kemp <steve@...ve.org.uk>
To: oss-security@...ts.openwall.com
Subject: Re: pinocchio tmp vuln
> I have to say I don't understand at all why someone would be going
> through random packages from PyPi (especially test automation related)
> and searching for possible security issues.
Because although the chances of them being exploited are low they
are genuine issues which have security implications.
There is copious documentation online about how file races are
bad, including this quick reference:
https://www.securecoding.cert.org/confluence/display/seccode/FIO21-C.+Do+not+create+temporary+files+in+shared+directories
PyPi? 've no idea why that was chosen, but I expect because it
is a large mass of code that has had little similar attention paid
to it in the past. node.js will probably be next, I'm sure lots of
modules exist created by inexperienced developers who haven't
considered the implications of posting new code libraries.
I did something similar looking for /tmp abuses in Debian
packages, via a very very automated scan:
http://blog.steve.org.uk/luonnos_viesti___31_hein_kuu_2014.html
Finding these issues was distressingly easy, and although in the
real world the chances of significant impact are minimal they were
genuine issues that should be reported and fixed.
Steve
--
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
