Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5811

Re: Scripts that run insecurely-downloaded code

Show all headers | View raw

https isn´t any more secure than http as long as you do not have a 
verifiably trustworthy server certificate that you can check for. As we 
know the certification authority system is totally broken. It is a bug 
if a build script tries to download something. It must work offline as 
well. I do not see any way than to rewrite these build scripts and pack 
all the necessary sources into the package for compiling it offline.

Am 01.05.20 um 20:54 schrieb Rebecca N. Palmer:
> Around 200 packages [0] include upstream scripts that download code via 
> (non-secure) http, then run it without an integrity check.
> 
> This is obviously a security hole (network MITM => code execution), but 
> not necessarily one that is opened by normal use of the package.  (E.g. 
> fetch-dependencies-and-build scripts can't download anything on a Debian 
> buildd, though it would still make sense to report them to upstream.)
> 
> Some instances of this (i.e. where the download origin offers it) are 
> trivially improvable by replacing http with https.
> 
> How should this be dealt with?
> - Mass report?
>    - As BTS bugs (i.e. public) or private email?
> - (imperfect) Lintian check based on [0]?
> - If one is fixed, should it also be fixed in stable?  (Probably depends 
> on how likely the script is to be used from the package)
> 
> Previous discussions that I can find [1-2] reached no clear conclusion, 
> possibly because there were other issues involved (the trustworthiness 
> of the downloads' intended origin, and whether downloaders had to be in 
> contrib).
> 
> [0] codesearch (wget|curl).*http://[^ ]*/[^ 
> ]*\.(pl|sh|py|gz|xz|bz2|zip)($|[^a-z]) matches 368 packages, but not all 
> of them are actual security problems
> [1] https://lists.debian.org/debian-security/2012/12/msg00030.html
> [2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449497
> 

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Scripts that run insecurely-downloaded code "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2020-05-01 21:20 +0200
  Re: Scripts that run insecurely-downloaded code Elmar Stellnberger <estellnb@elstel.org> - 2020-05-01 21:40 +0200
    Re: Scripts that run insecurely-downloaded code "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2020-05-01 22:20 +0200
      Re: Scripts that run insecurely-downloaded code Paul Wise <pabs@debian.org> - 2020-05-02 03:00 +0200
        Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 18:10 +0200
      Re: Scripts that run insecurely-downloaded code Davide Prina <davide.prina@gmail.com> - 2020-05-02 10:20 +0200
        Re: Scripts that run insecurely-downloaded code "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2020-05-02 11:10 +0200
        Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 18:30 +0200
          Re: Scripts that run insecurely-downloaded code Jason Fergus <leech@thefnords.org> - 2020-05-02 19:00 +0200
            Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 19:30 +0200
        Re: Scripts that run insecurely-downloaded code Celejar <celejar@gmail.com> - 2020-05-03 16:40 +0200
    Re: Scripts that run insecurely-downloaded code estellnb@elstel.org - 2020-05-02 18:20 +0200
  Re: Scripts that run insecurely-downloaded code Paul Wise <pabs@debian.org> - 2020-05-02 03:20 +0200

csiph-web