Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 May 2016 18:24:58 +0200
From: Michael Scherer <misc@...b.org>
To: oss-security@...ts.openwall.com
Subject: Re: BitKeeper /tmp vulns

On Tue, May 10, 2016 at 09:31:27AM -0600, Kurt Seifried wrote:
> Not found by me, mentioned on HackerNews:
> 
> https://github.com/bitkeeper-scm/bitkeeper/blob/master/src/bk.sh#L485

Just to clarify, the vuln was not mentioned on HN, just the new about it being
under a free license. Then I did a git clone, and grep /tmp and pointed on internal 
IRC that, as usual, there is a ton of /tmp issue (and then Kurt did see and asked where I did see it,
and answered on HN (to the question "bk is now opensource").
 
> BitKeeper is under Apache license so here it is.
> 
> Also a quick look at the source shows a ton of other potential /tmp/ vulns,
> CC'ing bitkeeper security

for example:
https://github.com/bitkeeper-scm/bitkeeper/blob/master/src/utils/bk_version#L1563 

There is also a few here:
https://github.com/bitkeeper-scm/bitkeeper/blob/master/src/utils/extractor.c

but that's the installation script, so unlikely to be exploitable.

Or in apply-patch, etc.

But there is also a few projects that are bundled (like zlib), and a few scripts that
are used only at installation and/or build time, so classifying everything is more 
work than what I have time to devote for the project.

-- 
Michael Scherer

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.