[Zope-Coders] FastCGI leaking Authorization header

[Shane Hathaway]

Matt Behrens wrote:
> On Sat, Aug 17, 2002 at 12:09:24PM -0400, Shane Hathaway wrote:
>>A hotfix would draw attention to a chink in the armor when there are 
>>actually gaping, unfixed holes in the whole web.
> 
> 
> I have never considered obscurity a valid defense.  Anyone who
> subscribes to zope-checkins already knows about this.  Anyone who
> knows how to do <dtml-var REQUEST> on a FastCGI-equipped server has
> seen it.

I agree that obscurity is never the way to attain security.

But I suggest we need to give the public the proper perspective.  It 
takes less creativity to craft a web page that will steal credentials 
using standard HTML tags than to exploit this.  Releasing a hotfix puts 
a big spotlight on a small issue that could affect only a small number 
of Zope sites, and even those sites will still have to deal with the 
very same risk even after the change: site managers should never browse 
to untrusted users' pages while logged in.

Take a look at what Distrowatch thinks of Zope:

http://www.distrowatch.com/packages.php

Distrowatch is a great site for choosing distributions and software 
packages.  When a site like this says nothing about what Zope is and 
just claims there are too many security issues, something is wrong.  And 
I don't think it's Zope itself that's wrong.  I think we've been too 
paranoid, releasing hotfixes that don't actually improve security, but 
just patch minor details, while the core issues remain.  Until we have 
"hat-switching", it will never be safe for privileged users to browse to 
untrusted users' pages.

Want an example? :-)  Let's say an untrusted user adds the following 
HTML to an untrusted page.

<img src="/Control_Panel/manage_shutdown" />

That's just the beginning, I'm afraid.  And Zope isn't the culprit. 
Instead of releasing minor patches, we should be working to solve the 
real problem.

Shane