Re: Requesting CVE-ID(s) for Python's pip

[Daniel Kahn Gillmor <dkg () fifthhorseman net>]

On 07/30/2013 02:29 AM, Kurt Seifried wrote:
> I'm not sure in this case MD5 alone is a security vulnerability, I
> think previously it had been decided that just because it uses MD5
> wasn't ernough to get a CVE, it had to have some specific use that
> made MD5 a problem. OTOH DES is at this point worthy of a CVE since
> you can crack it in a reasonable amount of time on AWS/etc for a few
> hundred bucks or less. Personally I would assign a CVE to everything
> using MD5 by default to try and help kill it off, but that would be a
> lot of CVEs.

Maybe it's worth examining what sort of attack vectors are possible when
MD5 is relied upon that are not possible if stronger digests are required.

MD5 is currently known to be vulnerable to collision attacks, but no one
(to my knowledge) has published anything close to an effective pre-image
attack yet.

I'm assuming that pip is checking the digests of a source tarball
fetched from a mirror based on a manifest that is signed by a well-known
key (if my understanding of the architecture is wrong, please correct me!)

here's one conceivable attack that exploits MD5's failed collision
resistance:

Consider an attacker who can upload a python module to the pypi
repository to get them included in the manifest, and who can tamper with
a mirror or can modify traffic on their victim's network.

This attacker could craft two versions of their module that have the
same MD5 digest, but one of them is innocuous and the other is malicious.

The attacker then uploads the innocuous one to the main archive, it is
vetted by whatever is the normal pypi policy, and its MD5 sum is
included in the standard signed manifest.  Then the victim goes to fetch
it, the attacker replaces the download with the malicious version.

If pip is only checking MD5 digests, it sees that the digest is correct,
and the victim has no idea that they received anything different than
the innocuous version.  The general public never sees the malicious code.

This attack requires that the attacker already have a significant set of
dangerous powers (uploading to pypi, control of the victim's chosen
mirror or network), but it enables them to pull off the attack in
secrecy at least.

Regards,

        --dkg

Attachment: signature.asc
Description: OpenPGP digital signature