Date: Tue, 10 May 2016 18:24:58 +0200 From: Michael Scherer <misc@...b.org> To: oss-security@...ts.openwall.com Subject: Re: BitKeeper /tmp vulns On Tue, May 10, 2016 at 09:31:27AM -0600, Kurt Seifried wrote: > Not found by me, mentioned on HackerNews: > > https://github.com/bitkeeper-scm/bitkeeper/blob/master/src/bk.sh#L485 Just to clarify, the vuln was not mentioned on HN, just the new about it being under a free license. Then I did a git clone, and grep /tmp and pointed on internal IRC that, as usual, there is a ton of /tmp issue (and then Kurt did see and asked where I did see it, and answered on HN (to the question "bk is now opensource"). > BitKeeper is under Apache license so here it is. > > Also a quick look at the source shows a ton of other potential /tmp/ vulns, > CC'ing bitkeeper security for example: https://github.com/bitkeeper-scm/bitkeeper/blob/master/src/utils/bk_version#L1563 There is also a few here: https://github.com/bitkeeper-scm/bitkeeper/blob/master/src/utils/extractor.c but that's the installation script, so unlikely to be exploitable. Or in apply-patch, etc. But there is also a few projects that are bundled (like zlib), and a few scripts that are used only at installation and/or build time, so classifying everything is more work than what I have time to devote for the project. -- Michael Scherer
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.