Date: Tue, 09 Sep 2014 09:38:29 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: pinocchio tmp vuln On 09/09/14 02:34 AM, Steve Kemp wrote: >> I have to say I don't understand at all why someone would be going >> through random packages from PyPi (especially test automation related) >> and searching for possible security issues. > > Because although the chances of them being exploited are low they > are genuine issues which have security implications. > > There is copious documentation online about how file races are > bad, including this quick reference: > > https://www.securecoding.cert.org/confluence/display/seccode/FIO21-C.+Do+not+create+temporary+files+in+shared+directories > > PyPi? 've no idea why that was chosen, but I expect because it > is a large mass of code that has had little similar attention paid > to it in the past. node.js will probably be next, I'm sure lots of > modules exist created by inexperienced developers who haven't > considered the implications of posting new code libraries. Actually one reason I picked PyPI is simply because it has popularity/usage info, each package web page says how many times it was downloaded in the last day/week/month, so I picked a quick an easy audit of packages downloaded more than 5000 times in the last month. Also this is to maybe help raise awareness of security a bit, things like tmp issues 1) shouldn't exist, especially in Python, mkstemp! mkdtemp! no need to reinvent attempts to create files securely, or to do it totally insecurely. 2) vendors should fix tmp, luckily this is happening, our PaaS OpenShift Enterprise, and the service OpenShift Online both use poly instantiated /tmp for each user cartridge (a cartridge is essentially on or more services/applications like PHP, MySQL, etc. being used to run something like say Wordpress). So the exploitation of tmp vulns on OpenShift would generally require additional vulnerabilities in order to get file system access (at which point a tmp vuln is likely not that interesting to an attacker, especially in the case of OpenShift and the way cartridges are restricted). > I did something similar looking for /tmp abuses in Debian > packages, via a very very automated scan: > > http://blog.steve.org.uk/luonnos_viesti___31_hein_kuu_2014.html > > Finding these issues was distressingly easy, and although in the > real world the chances of significant impact are minimal they were > genuine issues that should be reported and fixed. Yup. Also this is a way to unwind, I know a lot of people that play computer card games like solitaire to wind down, looking at tmp vulns is essentially the same pleasantly monotonous experience, at least for me =). Also a reminder: https://kurt.seifried.org/2012/03/14/creating-temporary-files-securely/ has a specific list of the correct ways to do it, if I'm missing a language let me know and I'll add it. > Steve > -- > -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.