Security
Tarsnap advisory provides a few lessons
An interesting and brutally honest security
advisory for the Tarsnap "secure online
backup service
" was released on January 18. It certainly shows a
refreshing amount of candor that other projects and companies would do well
to emulate. But there are some other lessons to be learned from the
vulnerability including the value of source code availability and the
perils of refactoring.
Tarsnap is a company founded by Colin Percival that provides encrypted online storage for backups. The client code is available, but it is not free software. The code can only be used, unmodified, to talk to the Tarsnap service. The server code is evidently completely unavailable, but Percival is interested in hearing from folks with ideas for improvement to the client—or those who have found a security hole.
Percival was contacted by Taylor R. Campbell on January 14 with just such a bug. It turns out that a refactoring of the code for the 1.0.22 release, which was made in June 2009, introduced a bug that potentially would allow anyone with access to the data to decrypt it. The data is stored in the Amazon S3 "cloud", which limits the access to a small group, but that doesn't really fit well with the security model espoused by Tarsnap. In the advisory, Percival makes that clear:
In doing the refactoring, Percival removed an auto-increment of a nonce value used in the Advanced Encryption Standard (AES) Counter (CTR) mode for encrypting blocks of data. The impact of that is that someone can decrypt the data without having the key.
There are two ways that the decryption could be done when the nonce value is reused, either by comparing two ciphertexts or by using known plaintext. The former attack is considered by Percival to be unusable on the Tarsnap data because of the compression done to the data blocks before they are encrypted. On the other hand, known plaintext attacks are quite plausible if there is some known data in the blocks. As Percival points out, full backups are likely to have any number of files with known contents, namely the files that are installed by the operating system—binaries, configuration files, and so on.
The bug was found by Campbell by "reading the Tarsnap source code
purely out of curiosity
", which certainly shows the advantage of
making that source available. One wonders if the server code might also
benefit from curious hackers. Percival is creating a bug bounty program
(and seemingly retroactively paying one out to Campbell) to hopefully
ferret out any other problems in the client sooner.
Refactoring is meant to be strictly a clean-up operation that does not
change the semantics of the code in question. When doing refactoring, it
is helpful if there are a set of regression tests that can detect when
refactoring has gone awry. In the comments on the advisory, Percival said
that Tarsnap does not have a test suite of that sort, and pointed out that
it is difficult to create one for cryptographic software, but "I
should probably find some way of automatically testing and/or assert()ing
for nonce-reuse bugs though
".
The lack of regression tests is unfortunate, but Tarsnap is hardly alone in that. There are countless projects that refactor their code without such a test suite. This particular incident should serve as something of a reminder to projects, especially those that are implementing security features, that refactoring can and does introduce bugs. A test suite is great, but even just some regression testing of the areas that have been refactored may find bugs like this one.
Percival is to be congratulated for quickly turning around a fix for the problem, as well as for being so forthright with the gory details of the bug and its impact. It is far too often that we see companies trying to sweep the details of their security holes under the rug—free software projects sometimes do as well. Bugs happen, security or otherwise, and there is value in seeing what they are and how they came about. We can learn from incidents like this.
Brief items
A critical security bug in tarsnap
The author of tarsnap ("online backups for the truly paranoid") has sent out an advisory describing a "critical" security bug in versions 1.0.22 through 1.0.27. "It may be possible for me, Amazon, or US government agencies with access to Amazon's datacenters to decrypt data stored with those versions of Tarsnap. This is an absolutely unacceptable compromise of Tarsnap's security principles, and I sincerely apologize to everyone affected." The posting describes how to respond to the problem and is an interesting discussion of how easily things can go wrong in security-related code.
New vulnerabilities
ccid: arbitrary code execution
| Package(s): | ccid | CVE #(s): | CVE-2010-4530 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 14, 2011 | Updated: | January 22, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
An integer overflow, leading to array index error was found in the way USB CCID (Chip/Smart Card Interface Devices) driver processed certain values of card serial number. A local attacker could use this flaw to execute arbitrary code, with the privileges of the user running the pcscd daemon, via a malicious smart card with specially-crafted value of its serial number, inserted to the system USB port. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
chromium: mysterious vulnerabilities
| Package(s): | chromium | CVE #(s): | CVE-2010-2898 CVE-2010-2899 CVE-2010-2900 CVE-2010-2901 CVE-2010-2902 CVE-2010-2903 | ||||||||||||||||||||||||||||
| Created: | January 19, 2011 | Updated: | August 23, 2011 | ||||||||||||||||||||||||||||
| Description: | The chromium browser suffers from a number of "unspecified" vulnerabilities with "unknown" impact. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
gif2png: denial of service
| Package(s): | gif2png | CVE #(s): | CVE-2010-4694 | ||||||||
| Created: | January 17, 2011 | Updated: | March 16, 2012 | ||||||||
| Description: | From the Mandriva advisory:
Buffer overflow in gif2png.c in gif2png 2.5.3 and earlier might allow context-dependent attackers to cause a denial of service (application crash) or have unspecified other impact via a GIF file that contains many images, leading to long extensions such as .p100 for PNG output files, as demonstrated by a CGI program that launches gif2png, a different vulnerability than CVE-2009-5018. | ||||||||||
| Alerts: |
| ||||||||||
hplip: arbitrary code execution
| Package(s): | hplip | CVE #(s): | CVE-2010-4267 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 18, 2011 | Updated: | August 22, 2013 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
A flaw was found in the way certain HPLIP tools discovered devices using the SNMP protocol. If a user ran certain HPLIP tools that search for supported devices using SNMP, and a malicious user is able to send specially-crafted SNMP responses, it could cause those HPLIP tools to crash or, possibly, execute arbitrary code with the privileges of the user running them. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
java-1_6_0-openjdk: security manager bypass
| Package(s): | java-1_6_0-openjdk | CVE #(s): | CVE-2010-4351 | ||||||||||||||||||||||||||||||||||||||||
| Created: | January 19, 2011 | Updated: | April 21, 2011 | ||||||||||||||||||||||||||||||||||||||||
| Description: | The IcedTea JNLP security manager implementation will, in some cases, fail to throw an expected exception when security policy is violated. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2010-4526 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 19, 2011 | Updated: | September 13, 2011 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | Yet another bug in the SCTP network protocol code allows a remote attacker to oops the kernel. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: multiple vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2010-4238 CVE-2010-4243 CVE-2010-4255 CVE-2010-4343 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 13, 2011 | Updated: | September 14, 2011 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory: * A missing sanity check was found in vbd_create() in the Xen hypervisor implementation. As CD-ROM drives are not supported by the blkback back-end driver, attempting to use a virtual CD-ROM drive with blkback could trigger a denial of service (crash) on the host system running the Xen hypervisor. (CVE-2010-4238, Moderate) * A flaw was found in the Linux kernel execve() system call implementation. A local, unprivileged user could cause large amounts of memory to be allocated but not visible to the OOM (Out of Memory) killer, triggering a denial of service. (CVE-2010-4243, Moderate) * A flaw was found in fixup_page_fault() in the Xen hypervisor implementation. If a 64-bit para-virtualized guest accessed a certain area of memory, it could cause a denial of service on the host system running the Xen hypervisor. (CVE-2010-4255, Moderate) * A missing initialization flaw was found in the bfa driver used by Brocade Fibre Channel Host Bus Adapters. A local, unprivileged user could use this flaw to cause a denial of service by reading a file in the "/sys/class/fc_host/host#/statistics/" directory. (CVE-2010-4343, Moderate) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libtiff: denial of service
| Package(s): | libtiff | CVE #(s): | CVE-2010-2596 CVE-2010-2630 CVE-2010-2631 CVE-2010-2482 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 19, 2011 | Updated: | March 15, 2011 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | The libtiff library contains a number of flaws which can be exploited to crash a running application. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
mydms: directory traversal
| Package(s): | mydms | CVE #(s): | CVE-2010-2006 | ||||
| Created: | January 17, 2011 | Updated: | January 19, 2011 | ||||
| Description: | From the Debian advisory:
D. Fabian and L. Weichselbaum discovered a directory traversal vulnerability in MyDMS, a open-source document management system based on PHP and MySQL. | ||||||
| Alerts: |
| ||||||
pcsc-lite: arbitrary code execution
| Package(s): | pcsc-lite | CVE #(s): | CVE-2010-4531 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 14, 2011 | Updated: | January 22, 2014 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
A stack-based buffer overflow flaw was found in the way PC/SC Lite smart card framework decoded certain attribute values of the Answer-to-Reset (ATR) message, received back from the card after connecting. A local attacker could use this flaw to execute arbitrary code with the privileges of the user running the pcscd daemon, via a malicious smart card inserted to the system USB port. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
perl-CGI: HTTP response splitting attacks
| Package(s): | perl-CGI | CVE #(s): | CVE-2010-4411 | ||||||||||||||||||||||||||||
| Created: | January 17, 2011 | Updated: | January 31, 2011 | ||||||||||||||||||||||||||||
| Description: | From the Mandriva advisory:
Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors. NOTE: this issue exists because of an incomplete fix for CVE-2010-2761. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
pimd: insecure temporary files
| Package(s): | pimd | CVE #(s): | CVE-2011-0007 | ||||||||
| Created: | January 17, 2011 | Updated: | January 19, 2011 | ||||||||
| Description: | From the Debian advisory:
Vincent Bernat discovered that pimd, a multicast routing daemon, creates files with predictable names upon the receipt of particular signals. | ||||||||||
| Alerts: |
| ||||||||||
prewikka: password leak
| Package(s): | prewikka | CVE #(s): | CVE-2010-2058 | ||||
| Created: | January 17, 2011 | Updated: | January 19, 2011 | ||||
| Description: | From the CVE entry:
setup.py in Prewikka 0.9.14 installs prewikka.conf with world-readable permissions, which allows local users to obtain the SQL database password. | ||||||
| Alerts: |
| ||||||
sssd: denial of service
| Package(s): | sssd | CVE #(s): | CVE-2010-4341 | ||||||||||||||||||||||||||||||||||||
| Created: | January 19, 2011 | Updated: | September 23, 2011 | ||||||||||||||||||||||||||||||||||||
| Description: | Sssd suffers from a bug in pam_parse_in_data_v2() which allows a local attacker to prevent other users from logging into the system. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
subversion: denial of service
| Package(s): | subversion | CVE #(s): | CVE-2010-4539 CVE-2010-4644 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 14, 2011 | Updated: | April 15, 2011 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mandriva advisory:
The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections (CVE-2010-4539). Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command (CVE-2010-4644). | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
sudo: group-related vulnerabilities
| Package(s): | sudo | CVE #(s): | CVE-2011-0008 CVE-2011-0010 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | January 19, 2011 | Updated: | March 22, 2012 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | It turns out that sudo does not ask for a password on group ID changes. CVE-2011-0008 is the return of CVE-2009-0034 (another group-oriented vulnerability) as the result of upstream changes. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
tor: multiple vulnerabilities
| Package(s): | tor | CVE #(s): | CVE-2011-0427 | ||||||||||||||||
| Created: | January 17, 2011 | Updated: | June 9, 2011 | ||||||||||||||||
| Description: | From the Debian advisory:
The developers of Tor, an anonymizing overlay network for TCP, found three security issues during a security audit. A heap overflow allowed the execution of arbitrary code (CVE-2011-0427), a denial of service vulnerability was found in the zlib compression handling and some key memory was incorrectly zeroed out before being freed. The latter two issues do not yet have CVE identifiers assigned. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
wireshark: arbitrary code execution
| Package(s): | wireshark | CVE #(s): | CVE-2011-0444 | ||||||||||||||||||||||||||||
| Created: | January 14, 2011 | Updated: | April 19, 2011 | ||||||||||||||||||||||||||||
| Description: | From the Mandriva advisory:
Buffer overflow in the MAC-LTE dissector (epan/dissectors/packet-mac-lte.c) in Wireshark 1.2.0 through 1.2.13 and 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of RARs. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
xfig: multiple vulnerabilities
| Package(s): | xfig | CVE #(s): | CVE-2009-4227 CVE-2009-4228 | ||||||||||||||||||||||||
| Created: | January 17, 2011 | Updated: | December 15, 2014 | ||||||||||||||||||||||||
| Description: | From the Mandriva advisory:
Stack-based buffer overflow in the read_1_3_textobject function in f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject function in read1_3.c in fig2dev in Transfig 3.2.5a and earlier, allows remote attackers to execute arbitrary code via a long string in a malformed .fig file that uses the 1.3 file format. NOTE: some of these details are obtained from third party information (CVE-2009-4227). Stack consumption vulnerability in u_bound.c in Xfig 3.2.5b and earlier allows remote attackers to cause a denial of service (application crash) via a long string in a malformed .fig file that uses the 1.3 file format, possibly related to the readfp_fig function in f_read.c (CVE-2009-4228). | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>