Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <5296CDD2.5010009@redhat.com>
Date: Wed, 27 Nov 2013 22:00:02 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: hplip insecure temporary file handling
 in pkit.py

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/27/2013 05:10 AM, Sebastian Krahmer wrote:
> Hi,
> 
> Funny. I just told upstream about that yesterday:
> 
> https://bugzilla.novell.com/show_bug.cgi?id=852368
> 
> I think hplip could deserve a deeper look.
> 
> Sebastian

I'll be honest, this is how I audit for tmp files:

find ./ -type f -exec grep "/tmp" {} \;

Then I look to see how those files/dirs are created, if it's anything
other than the secure ways listed here:

http://kurt.seifried.org/2012/03/14/creating-temporary-files-securely/

it's probably wrong. I can't think of any software I've looked at that
have been 100% correct (there were two that were correct in the actual
code but had tests/etc. that were insecure).

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBAgAGBQJSls3SAAoJEBYNRVNeJnmTlsEP/jBKHK5OcOKN+YrnI+j+Mr/B
XRBJ/r52eBlSvXowieEq8mk2M3oEAWDizhZkGTID/u8brclXBrUQdoQt2u2eA/pc
arSoZfgDdVaQ5qgC+hEx+43XPemrVLDCRmR2f71XXUWS0mK7LvxGQthYnjWAlal7
XyF6N3KjCEOXWIVTiPGEFDnQ/wuIsl31ZPL7/5lZpCXOMX/HEFMS+oywyJ7tWCWq
CoS4GvBAyz/g1EG/X+lMWZCGtw8OSM1CrcqWp5WhTCMT1Uiw5ZADcS/YdALnXd4J
umlrR4bc3z1GSbREeCEaz9zdtKFWtX1ggbruzSmuw4JjZ+GppbT0lOOaZKmqP9wv
V9aqnjZXfUUJ7yqpi/6MB738A5E13TyPr6F+Vz8fAnx1SmPaTx3ydzMCoD7EuvXc
ApyJbn7u4xHpoRrN55MfN517fII3ptEoObPVFXEtKG0HbFu8V5SATruXWKQO6Wmx
Hd5+Tfp0aUvoA+iJwDxjlWxWj+mSni6ayAK7bbWUt7RmY0talz/jaIkCzXeHD9qn
+wamFEu11oVDZha/B/EZBL6r+tgImIPiMUWcbXvt5sfERqVyJwYoSaTa3mSrZ8Ly
ehsENBfC6NlKPy2NUf23q2MlX8lbudQHm30F1+ea6hSd86Y0k5sfgyrIq2fQLCzD
1U/hrAUnVICXFPQ2UHQ1
=GJSU
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.