[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 9 Sep 2014 11:57:11 +0300
From: Mikko Korpela <mikko.korpela@...il.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: pinocchio tmp vuln
I would say that the major impact for test automation tool for using a
fixed location for some file is that there can't be more then one
instance of that tool running on the same machine. Which is an issue
when you try to scale your testing.
Test automation on the other hand IMHO requires that we are working in
a secure sand box. If there is a malicious user on the same machine
then I bet things have already gone very wrong somewhere else.
Ystävällisin terveisin ;) ,
Mikko
2014-09-09 11:34 GMT+03:00 Steve Kemp <steve@...ve.org.uk>:
>> I have to say I don't understand at all why someone would be going
>> through random packages from PyPi (especially test automation related)
>> and searching for possible security issues.
>
> Because although the chances of them being exploited are low they
> are genuine issues which have security implications.
>
> There is copious documentation online about how file races are
> bad, including this quick reference:
>
> https://www.securecoding.cert.org/confluence/display/seccode/FIO21-C.+Do+not+create+temporary+files+in+shared+directories
>
> PyPi? 've no idea why that was chosen, but I expect because it
> is a large mass of code that has had little similar attention paid
> to it in the past. node.js will probably be next, I'm sure lots of
> modules exist created by inexperienced developers who haven't
> considered the implications of posting new code libraries.
>
> I did something similar looking for /tmp abuses in Debian
> packages, via a very very automated scan:
>
> http://blog.steve.org.uk/luonnos_viesti___31_hein_kuu_2014.html
>
> Finding these issues was distressingly easy, and although in the
> real world the chances of significant impact are minimal they were
> genuine issues that should be reported and fixed.
>
> Steve
> --
--
Mikko Korpela
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
