[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20130801155620.GZ1472@yuggoth.org>
Date: Thu, 1 Aug 2013 15:56:21 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: Re: Requesting CVE-ID(s) for Python's pip
On 2013-08-01 14:03:35 +0000 (+0000), isis agora lovecruft wrote:
> On Jul 30, 2013, at 2:29 AM, Kurt Seifried <kseifried@...hat.com> wrote:
> [...]
> > I'm not sure in this case MD5 alone is a security vulnerability,
> > I think previously it had been decided that just because it uses
> > MD5 wasn't ernough to get a CVE, it had to have some specific
> > use that made MD5 a problem.
[...]
> Marc Stevens recently published a paper on using probabilistic
> conditionals to control differential computation for two-block MD5
> collisions
[...]
But as we discussed the last time this came up, realistic attack
vectors like "pad my malicious payload so that it hashes to the same
value as the official uploaded content from the real author" require
a second preimage attack. The paper you cited is merely about
improving the time needed to mount a collision attack (picking two
datasets which hash to the same value).
https://en.wikipedia.org/wiki/Preimage_attack
So the worst exploit I can envision from this is that a malicious
author constructs two programs. One is benign, and gets code
reviewed and uploaded. Then at some point the second, which is
malicious in nature, is surreptitiously uploaded in place of the
first and nobody notices the switch.
--
{ PGP( 48F9961143495829 ); FINGER( fungi@...ulhu.yuggoth.org );
WWW( http://fungi.yuggoth.org/ ); IRC( fungi@....yuggoth.org#ccl );
WHOIS( STANL3-ARIN ); MUD( kinrui@...arsis.mudpy.org:6669 ); }
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
