[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 May 2016 18:24:58 +0200
From: Michael Scherer <misc@...b.org>
To: oss-security@...ts.openwall.com
Subject: Re: BitKeeper /tmp vulns
On Tue, May 10, 2016 at 09:31:27AM -0600, Kurt Seifried wrote:
> Not found by me, mentioned on HackerNews:
>
> https://github.com/bitkeeper-scm/bitkeeper/blob/master/src/bk.sh#L485
Just to clarify, the vuln was not mentioned on HN, just the new about it being
under a free license. Then I did a git clone, and grep /tmp and pointed on internal
IRC that, as usual, there is a ton of /tmp issue (and then Kurt did see and asked where I did see it,
and answered on HN (to the question "bk is now opensource").
> BitKeeper is under Apache license so here it is.
>
> Also a quick look at the source shows a ton of other potential /tmp/ vulns,
> CC'ing bitkeeper security
for example:
https://github.com/bitkeeper-scm/bitkeeper/blob/master/src/utils/bk_version#L1563
There is also a few here:
https://github.com/bitkeeper-scm/bitkeeper/blob/master/src/utils/extractor.c
but that's the installation script, so unlikely to be exploitable.
Or in apply-patch, etc.
But there is also a few projects that are bundled (like zlib), and a few scripts that
are used only at installation and/or build time, so classifying everything is more
work than what I have time to devote for the project.
--
Michael Scherer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
