September 2013 - security [ARCHIVED]

[Secure Coding] master: C++ operator new[] has been fixed in recent GCC versions (e32825c)

by fweimer＠fedoraproject.org

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit e32825c5c6860a273c27896c390b1219ba651f66 Author: Florian Weimer <fweimer(a)redhat.com> Date: Tue Sep 17 11:11:39 2013 +0200 C++ operator new[] has been fixed in recent GCC versions >--------------------------------------------------------------- defensive-coding/en-US/CXX-Language.xml | 16 +++++++++------- 1 files changed, 9 insertions(+), 7 deletions(-) diff --git a/defensive-coding/en-US/CXX-Language.xml b/defensive-coding/en-US/CXX-Language.xml index 9dbc4f3..b6e6df9 100644 --- a/defensive-coding/en-US/CXX-Language.xml +++ b/defensive-coding/en-US/CXX-Language.xml @@ -19,8 +19,9 @@ array. Current GCC versions generate code that performs a computation of the form <literal>sizeof(T) * size_t(n) + cookie_size</literal>, where <literal>cookie_size</literal> is - currently at most 8. This computation can overflow, and - GCC-generated code does not detect this. + currently at most 8. This computation can overflow, and GCC + versions prior to 4.8 generated code which did not detect this. + (Fedora 18 was the first release which fixed this in GCC.) </para> <para> The <literal>std::vector</literal> template can be used instead @@ -28,11 +29,12 @@ overflow internally.) </para> <para> - If there is no alternative to <literal>operator new[]</literal>, - code which allocates arrays with a variable length must check - for overflow manually. For the <literal>new T[n]</literal> - example, the size check could be <literal>n || (n > 0 && - n > (size_t(-1) - 8) / sizeof(T))</literal>. (See <xref + If there is no alternative to <literal>operator new[]</literal> + and the sources will be compiled with older GCC versions, code + which allocates arrays with a variable length must check for + overflow manually. For the <literal>new T[n]</literal> example, + the size check could be <literal>n || (n > 0 && n > + (size_t(-1) - 8) / sizeof(T))</literal>. (See <xref linkend="sect-Defensive_Coding-C-Arithmetic"/>.) If there are additional dimensions (which must be constants according to the C++ standard), these should be included as factors in the

10 years, 7 months

1
0
0 / 0

Reproducible Builds in Fedora

by Dhiru Kholia

Hi, I have been working on having Reproducible Builds in Fedora for some time. At this point, I think I have something demoable. Ensuring Reproducible Builds is a big task and I want your feedback, ideas, code and support. Please see https://github.com/kholia/ReproducibleBuilds for details. I would like to thank Debian and Ubuntu folks for starting similar projects (and inspiring this work). Reproducible Builds =================== It should be possible to reproduce every build of every package in Fedora. We want to be able to show that our binary was the result of our source code from our compiler and nobody added anything along the way. Can we (upstream / vendor) show that one of our rpms was built from the source we ship? It should be possible for the users to verify that the binary matches what the source intended to produce, in an independent fashion. We (the distribution provider) shouldn't be forced to say "Trust Us" to our users at all. Steps Involved ============== * Recording the build environment (DONE) - Koji does this automatically :-) * Re-producing the build environment (DONE) - Retrieve "brootid" (buildrootID) corresponding to the NVR we want to test from Koji (DONE) - Replicate this buildroot (DONE) - Create replica build environment using "Mock" (DONE) * Do re-builds locally using mock (DONE) * Verify new build against upstream (DONE, Steve's script works great) Current State ============= * Packages like git, john and qpdf are 100% reproducible as far as code is concerned :-) Current Challenges ================== See http://tinyurl.com/ReproducibleBuildsProblems * python-epydoc will add timestamps to the HTML file it produces ( needs FIXING). * javadoc will add timestamps to the HTML file it produces (needs FIXING). Links ===== https://wiki.debian.org/ReproducibleBuilds http://fedoraproject.org/wiki/Releases/FeatureBuildId#Unique_build_ID http://blogs.kde.org/2013/06/19/really-source-code-software https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-a... https://trac.torproject.org/projects/tor/ticket/5837 https://trac.torproject.org/projects/tor/ticket/3688 http://bazaar.launchpad.net/~ubuntu-security/ubuntu-security-tools/trunk/... -- Dhiru

10 years, 7 months

1
0
0 / 0

[Secure Coding] master: Regenerate snippets (5b90f99)

by fweimer＠fedoraproject.org

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 5b90f9975381095a48beab469167da3d870c39ab Author: Florian Weimer <fweimer(a)redhat.com> Date: Mon Sep 16 15:11:29 2013 +0200 Regenerate snippets >--------------------------------------------------------------- .../C-String-Functions-strncat-as-strncpy.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/defensive-coding/en-US/snippets/C-String-Functions-strncat-as-strncpy.xml b/defensive-coding/en-US/snippets/C-String-Functions-strncat-as-strncpy.xml index 0895eaf..1f5c8c6 100644 --- a/defensive-coding/en-US/snippets/C-String-Functions-strncat-as-strncpy.xml +++ b/defensive-coding/en-US/snippets/C-String-Functions-strncat-as-strncpy.xml @@ -4,5 +4,5 @@  <programlisting language="C"> buf[0] = '\0'; -strncpy(buf, data, sizeof(buf) - 1); +strncat(buf, data, sizeof(buf) - 1); </programlisting>

10 years, 7 months

1
0
0 / 0

[Secure Coding] master: Actually use strncat in the strncat example (805f9a8)

by fweimer＠fedoraproject.org

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 805f9a85c843413140c867922bc2695cbbd1766a Author: Florian Weimer <fweimer(a)redhat.com> Date: Mon Sep 16 15:08:29 2013 +0200 Actually use strncat in the strncat example Spotted by Thomas Miletich <thomas.miletich(a)gmail.com>. >--------------------------------------------------------------- defensive-coding/src/C-String-Functions.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/defensive-coding/src/C-String-Functions.c b/defensive-coding/src/C-String-Functions.c index 34d9c31..9f8898a 100644 --- a/defensive-coding/src/C-String-Functions.c +++ b/defensive-coding/src/C-String-Functions.c @@ -70,7 +70,7 @@ main(void) assert(strncmp(buf, data, 9) == 0); //+ C String-Functions-strncat-as-strncpy buf[0] = '\0'; - strncpy(buf, data, sizeof(buf) - 1); + strncat(buf, data, sizeof(buf) - 1); //- } {

10 years, 7 months

1
0
0 / 0

[Secure Coding] tag 'v1.1-1' created

by fweimer＠fedoraproject.org

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git New tag : v1.1-1 Referencing: 111c29e564bccac7e358ad0a65a5632301b130f8

10 years, 7 months

1
0
0 / 0

Fedora Security SIG Update

by Eric Christensen

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 The Fedora Security SIG is coming back with a new mission and new momentum. Previously the Security SIG concentrated on security responses to vulnerabilities and answered questions from the Fedora community. While this service isn't going away we will be adding two new functions: secure coding education and code audit services. Our secure coding mission is primarily educational. Writing software is really hard, writing secure software is even harder. There's no way any software will ever be written without bugs, but we can try to avoid some of the most common mistakes. Our first steps are to document the common causes for security vulnerabilities in software and provide information on preventing these vulnerabilities from happening. Red Hat has started to track a subset of security flaws using Common Weakness Enumaration (CWE) IDs, this needs to be expanded to cover Fedora security bugs. We also have a secure coding guide, the Defensive Coding Guide[0], that is in the works, along with additional documentation. For code audits, we're really not sure where to start. We want to involve the community in this project, but honestly, we're not totally sure what that means. In the short term we expect to just be more transparent about what sort of work Red Hat is doing in this area and try to make public whatever information we can about code audits; this can be sensitive obviously. If contributors have ideas, or want to help, please join the discussion. This project is expected to evolve substantially over the next few months. As everyone knows, security is a big deal and keeps getting more important every day. Historically Fedora has done a fantastic job with security, one of the reasons the previous SIG never really took off is because there was no need, Fedora was mostly secure and didn't need fixing. While Fedora ils still secure, there is a lot of opportunity to help. The nature of security is changing very rapidly, technologies like mobile and cloud are changing everything. Rather than sit by and let this happen, we believe Fedora should be out in front, working with the community to ensure open source remains the most secure solutions available. But don't let what has been said so far become a limit on what can be done. I'd love to start working providing OVAL data, security bulletins, consult when questions arise and more. If you have ideas please join up and lets start working! You can find us on Freenode IRC in #fedora-security, on our mailing list[1], and in our GIT repository[2]. We look forward to your help. [0] https://docs.fedoraproject.org/en-US/Fedora_Security_Team//html/Defensive... [1] https://lists.fedoraproject.org/mailman/listinfo/security [2] https://fedorahosted.org/secure-coding/ - -- Eric - -------------------------------------------------- Eric "Sparks" Christensen Fedora Project - Red Hat sparks(a)redhat.com - sparks(a)fedoraproject.org 097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1 - -------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQGcBAEBCgAGBQJR3BEmAAoJEB/kgVGp2CYvcJ8L/RE75c9Ww/B8cNe2pwTBD9yv 6FGfK50QFMlRC6voq2Fd5RZb8Hf+PKoxw4+ewbUYdnN8t0n+DaEvPxP69hJtgJ5N N1736+aD6OiiArKrdfBO4A9syXfMEmOPsqmye7WuXrripJc8asxu8jrh1DgEjwXk rFrI2pau3upnzkwRHDTRnMPZ925g3BE7SnHa+UD2KZQ3B29Qos3FHmaX5Kn3LXf+ 3h+zNnIVkClGr1HK56QVxgsjNWApIH/HsCspxwOpr3ULKRvWD8FJjVxEyp1EDCrc Fw0C6Di7hbzM5VNVpg4CUpquoG9QCnbNniF+IEIzcBWHr1MEKSmq64xFhfXFS0Zx w0wWmDQHmwBYxp+v9FKzuGbyb5YQAkZm7z/wRu1dfL6d39LBzG5y48zIEgmIUL6t eZX5o+lAc/3/W9sKfBbB0dmEq9m02jTIER96aD8iXNEyU8B6Yr34fnWyTiJ6BmYA Z0/ZPvq+vRJGl/F+pZkhekm8yYxA+4R8AdUnDwTt1A== =AU1I -----END PGP SIGNATURE-----

10 years, 7 months

10
21
0 / 0

Fedora privilege escalation policy

by Josh Bressers

Hi all, I'm working through some of my backlog today and came across this fesco ticket https://fedorahosted.org/fesco/ticket/1117 Does anyone have any ideas or suggestions? I sadly don't currently have a ton of time to chase this one. Thanks. -- Josh Bressers / Red Hat Product Security Team

10 years, 7 months

2
2
0 / 0

[Secure Coding] master: Serialization: Mention that shelve is problematic, too (43ab73b)

by fweimer＠fedoraproject.org

Repository : http://git.fedorahosted.org/git/?p=secure-coding.git On branch : master >--------------------------------------------------------------- commit 43ab73b25747bbde0052ad266fa5470c6b1d98a0 Author: Florian Weimer <fweimer(a)redhat.com> Date: Wed Sep 4 16:19:19 2013 +0200 Serialization: Mention that shelve is problematic, too >--------------------------------------------------------------- defensive-coding/en-US/Tasks-Serialization.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/defensive-coding/en-US/Tasks-Serialization.xml b/defensive-coding/en-US/Tasks-Serialization.xml index 456da55..008e75b 100644 --- a/defensive-coding/en-US/Tasks-Serialization.xml +++ b/defensive-coding/en-US/Tasks-Serialization.xml @@ -64,7 +64,7 @@ <itemizedlist> <listitem><para> Python's <package>pickle</package> and <package>cPickle</package> - modules + modules, and wrappers such as <package>shelve</package> </para></listitem> <listitem><para> Perl's <package>Storable</package> package

10 years, 7 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

security [ARCHIVED] September 2013