[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <507EEB6C.40506@debian.org>
Date: Wed, 17 Oct 2012 18:31:24 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: ruby file creation due in insertion
of illegal NUL character
On 17/10/12 10:44, Fabian Keil wrote:
> Daniel Kahn Gillmor <dkg@...thhorseman.net> wrote:
>> On 10/16/2012 08:40 AM, Matthias Weckbecker wrote:
>>> Technically, this would also apply to Perl (at least with
>>> 5.12.3).
>>
>> It's also the case with perl 5.14.2 (just tested). :/
>
> At least for Perl I consider this a feature.
It's difficult to reason about whether this is a bug or a feature
without knowing the justification for treating the Ruby version as a
security vulnerability, which was not included in the announcement.
One possible justification is this: suppose a webapp writes files with
an attacker-controlled name to the web-server-visible /uploads/
directory, using this pseudocode:
if (filename ends with .jpg) {
open_for_writing(filename).write(content)
}
else {
error "that's not a JPEG, go away"
}
and suppose that the web server also executes *.php files in that
directory. Then an attacker could upload "evil.php\0.jpg", and browse
to http://example.com/uploads/evil.php to get their payload executed.
Is this what the Ruby people had in mind, or is there some other
attack vector I'm not seeing?
> if there is no white list [of characters] in the first place, the
> Perl script probably has bigger issues.
As you imply, that pseudocode is a bad idea anyway: the webapp should
be ensuring that the filenames match a pattern more like
/^[A-Za-z0-9_]\.jpg$/ (or not allowing user-controlled filenames at
all), and/or the web server should be configured so it never trusts
files in the uploads directory (either as executable code or something
like .htaccess).
Anything vulnerable to this sort of trickery is probably vulnerable to
file-overwriting attacks via "../" path segments, too.
S
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
