oss-sec mailing list archives
Re: pinocchio tmp vuln
From: Steve Kemp <steve () steve org uk>
Date: Tue, 9 Sep 2014 09:34:35 +0100
I have to say I don't understand at all why someone would be going through random packages from PyPi (especially test automation related) and searching for possible security issues.
Because although the chances of them being exploited are low they are genuine issues which have security implications. There is copious documentation online about how file races are bad, including this quick reference: https://www.securecoding.cert.org/confluence/display/seccode/FIO21-C.+Do+not+create+temporary+files+in+shared+directories PyPi? 've no idea why that was chosen, but I expect because it is a large mass of code that has had little similar attention paid to it in the past. node.js will probably be next, I'm sure lots of modules exist created by inexperienced developers who haven't considered the implications of posting new code libraries. I did something similar looking for /tmp abuses in Debian packages, via a very very automated scan: http://blog.steve.org.uk/luonnos_viesti___31_hein_kuu_2014.html Finding these issues was distressingly easy, and although in the real world the chances of significant impact are minimal they were genuine issues that should be reported and fixed. Steve --
Current thread:
- pinocchio tmp vuln Kurt Seifried (Sep 08)
- Re: pinocchio tmp vuln David Jorm (Sep 08)
- Re: pinocchio tmp vuln Mikko Korpela (Sep 09)
- Re: pinocchio tmp vuln Steve Kemp (Sep 09)
- Re: pinocchio tmp vuln Mikko Korpela (Sep 09)
- Re: pinocchio tmp vuln Henri Salo (Sep 09)
- Re: pinocchio tmp vuln Kurt Seifried (Sep 09)
- Re: pinocchio tmp vuln Donald Stufft (Sep 11)
- Re: pinocchio tmp vuln Mikko Korpela (Sep 09)
- Re: pinocchio tmp vuln John Haxby (Sep 09)
- Re: pinocchio tmp vuln Mikko Korpela (Sep 09)
- Re: pinocchio tmp vuln John Haxby (Sep 11)
- Re: pinocchio tmp vuln Kurt Seifried (Sep 11)
- Re: pinocchio tmp vuln Kurt Seifried (Sep 11)
- Re: pinocchio tmp vuln Mikko Korpela (Sep 11)
- Re: pinocchio tmp vuln David Jorm (Sep 08)