[Zope-Coders] FastCGI leaking Authorization header

[Matt Behrens]

--v9Ux+11Zm5mwPlX6
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Aug 19, 2002 at 10:06:49AM -0400, Shane Hathaway wrote:

> Releasing a hotfix puts=20
> a big spotlight on a small issue that could affect only a small number=20
> of Zope sites, and even those sites will still have to deal with the=20
> very same risk even after the change: site managers should never browse=
=20
> to untrusted users' pages while logged in.

I consider it larger.  First of all, you're not limited to site
managers.  The planted DTML can sit there and gather passwords quite
silently for a long period of time without getting noticed.  The
example you quote below (the whole class of "fooling the browser"
bits) will get noticed, and hopefully undone.

> Take a look at what Distrowatch thinks of Zope:
>=20
> http://www.distrowatch.com/packages.php

As a (former) packager (I left OpenBSD), I think the statement on
this page is uninformed and certainly unjustified.  Zope's problem
with packaging is that it is hard to package, and I have tried to
make strides in the direction of fixing that.  It is no small task,
IMO because Zope doesn't fit established free software package
molds.

I expressed my thoughts to the maintainer of that pages, and asked
him for more information on how he drew his conclusion.

> Distrowatch is a great site for choosing distributions and software=20
> packages.  When a site like this says nothing about what Zope is and=20
> just claims there are too many security issues, something is wrong.  And=
=20
> I don't think it's Zope itself that's wrong.

Yes.  We shall see what exactly is wrong when (if?) I get my answer.

> I think we've been too=20
> paranoid, releasing hotfixes that don't actually improve security, but=20
> just patch minor details, while the core issues remain.

I disagree, but you already knew that. :-)

> Until we have=20
> "hat-switching", it will never be safe for privileged users to browse to=
=20
> untrusted users' pages.

Yes.  I don't see anyone implementing this anytime soon.  But I
will settle for more security rather than less security and a warm
fuzzy feeling.

> Want an example? :-)  Let's say an untrusted user adds the following=20
> HTML to an untrusted page.
>=20
> <img src=3D"/Control_Panel/manage_shutdown" />
>=20
> That's just the beginning, I'm afraid.  And Zope isn't the culprit.=20
> Instead of releasing minor patches, we should be working to solve the=20
> real problem.

Didn't someone propose POST being required for manage methods for
this very reason?  I don't recall why it got decided that it was a
bad idea, but I'm betting it was in the name of backwards compatibility.
Heck, I might have participated in the shooting-down.

--=20
Matt Behrens <matt@zigg.com> <URL:http://zigg.com/>

--v9Ux+11Zm5mwPlX6
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)

iD8DBQE9YQwx+xq4JbgNGlMRArnYAKC2r7zmA+FfJ2GvInhpRB+caPWulwCghG4y
0eFRKlgIuTZxvYPo+f9ZA5c=
=JAvf
-----END PGP SIGNATURE-----

--v9Ux+11Zm5mwPlX6--