oss-security - Re: Possible data loss or data modification in ownCloud

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <502590A9.1050107@debian.org>
Date: Fri, 10 Aug 2012 23:52:25 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
CC: Bruno Kleinert <fuddl@...ian.org>
Subject: Re: Possible data loss or data modification in ownCloud

On 10/08/12 10:25, Bruno Kleinert wrote:
> if ($source) { +               switch ($mode) { +
> case 'r+': +                       case 'rb+': ... +
> case 'a': +                       case 'ab': +
> if (!$this->is_writable($path)) { +
> return false; +                               }

I find this suspicious. Surely this should be enumerating the modes
that are safe, rather than the modes that are not safe? With that
patch, if a new value for $mode is added, it's assumed to be a read
operation. It seems much safer to assume that unknown modes are writes:

    switch ($mode) {
        case 'r':
        case 'rb':
            break;
        default:
            if (!$this->is_writable($path)) {
                return false;
            }
    }

Regards,
    S

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.