All the Perl that's Practical to Extract and Report

my code is gold

statico on 2005-12-13T05:34:08

This past Spring, at some point in my Software Development class, I had an opportunity to mimic a joke I once heard. Professor, I said, all my code is perfect. I assume that any bugs I find are in the Perl language itself. It was funny because it was so absurd. We all laughed and chortled.

Now, it's not funny anymore. A claim with this level of silliness has appeared.

First, consider the basics of trusting user input. Would you ever write the following CGI script?

#!/bin/sh
echo "Content-type: text/plain"
echo
eval $QUERY_STRING

Somewhere, halfway around the world, a kid punches in http://example.com/user/you/test.cgi?rm%20-rf%20" and erases what he can of your hard drive and attached storage. The consequences are obvious.

After this occurred, however, would you blame sh? Is every implementation of sh around the planet broken? Of course not. So why is Webmin blaming Perl for a similar mistake?

Perl syslog bug attack

Effects Webmin versions below 1.250 and Usermin versions below 1.180, with
syslog logging enabled.
    
    When logging of failing login attempts via syslog is enabled, an
    attacker can crash and possibly take over the Webmin webserver, due to
    a bug in Perl's syslog function. [...]

Take a look at the vulnerability details. Webmin passes some user input right to sprintf, which is known to be about as safe to pass user input to as the eval keyword. Yet, the developers blame Perl.

(A correction has been emailed.)

I can see their point...

Phred on 2005-12-13T06:04:15

There is change in the Apache logging API starting at 2.0.49 which escapes data written to the error logs. See this link on the mod_perl website. So their may be some concern for those running webmin as root. But in my experience, it's always preferable to run daemons as non privileged users whenever possible.

Re:I can see their point...

Phred on 2005-12-13T06:07:03

Yikes, what happened to my grammar in that last comment? Where's the edit button? :)

Update

statico on 2005-12-13T07:00:39

After some communcation, the description of the security notice on the Webmin site has been updated, but the incorrect title remains.

Details

rafael on 2005-12-13T09:19:27

More details at the Perl foundation weblog.

Update #2

statico on 2005-12-13T22:30:03

The title has been fixed, plus there's an announcement on the use Perl; main page.

Hmmm

Abigail on 2005-12-14T11:27:42

Let's see. Webmin uses Sys::Syslog, whose syslog function, unlike its C-library cousin, passes its arguments to sprintf, a Perl function that contains an integer overflow bug. sprintf also happily accepts tainted data.

Yet you claim the fault lies entirely at the side of webmin.

I disagree. Sure, webmin has a fault, but the results of the fault wouldn't be as damaging as they are now because of the overflow bug in sprintf.