Your message dated Thu, 22 Sep 2005 00:43:10 +0200
with message-id <[EMAIL PROTECTED]>
and subject line security threat to postgresql applications
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 13 Mar 2003 08:22:18 +0000
>From [EMAIL PROTECTED] Thu Mar 13 02:22:18 2003
Return-path: <[EMAIL PROTECTED]>
Received: from moutng.kundenserver.de [212.227.126.187]
by master.debian.org with esmtp (Exim 3.12 1 (Debian))
id 18tNyi-0002LS-00; Thu, 13 Mar 2003 02:22:16 -0600
Received: from [212.227.126.160] (helo=mrelayng.kundenserver.de)
by moutng.kundenserver.de with esmtp (Exim 3.35 #1)
id 18tNyh-0005Ox-00
for [EMAIL PROTECTED]; Thu, 13 Mar 2003 09:22:15 +0100
Received: from [80.131.206.28] (helo=goofy.thiele-intern)
by mrelayng.kundenserver.de with asmtp (Exim 3.35 #1)
id 18tNyg-0001p6-00
for [EMAIL PROTECTED]; Thu, 13 Mar 2003 09:22:14 +0100
Date: Thu, 13 Mar 2003 09:22:13 +0100
From: Erik Thiele <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: security threat to postgresql applications
Message-Id: <[EMAIL PROTECTED]>
Organization: Thiele-Hydraulik
X-Mailer: Sylpheed version 0.8.10 (GTK+ 1.2.10; i686-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Delivered-To: [EMAIL PROTECTED]
X-Spam-Status: No, hits=-0.7 required=4.0
tests=HAS_PACKAGE,NOSPAM_INC,SIGNATURE_SHORT_DENSE,
SPAM_PHRASE_00_01
version=2.44
X-Spam-Level:
Package: postgresql
Version: 7.2.1-2woody2
if an application is linked against libpq, then the user is able to
specify environmental variables to override the defaults:
PGPORT sets the default TCP port number or Unix-domain socket file
extension for communicating with the PostgreSQL backend.
PGDATABASE sets the default PostgreSQL database name.
PGUSER sets the user name used to connect to the database and for
authentication.
PGPASSWORD sets the password used if the backend demands password
authentication. This is not recommended because the password can be read
by others using the ps command with special options on some platforms.
PGREALM sets the Kerberos realm to use with PostgreSQL, if it is
different from the local realm. If PGREALM is set, PostgreSQL
applications will attempt authentication with servers for this realm and
use separate ticket files to avoid conflicts with local ticket files.
This environment variable is only used if Kerberos authentication is
selected by the backend.
PGOPTIONS sets additional runtime options for the PostgreSQL backend.
PGTTY sets the file or tty on which debugging messages from the backend
server are displayed.
PGDATESTYLE sets the default style of date/time representation.
PGTZ sets the default time zone.
PGCLIENTENCODING sets the default client encoding (if multibyte support
was selected when configuring PostgreSQL).
PGGEQO sets the default mode for the genetic optimizer.
the usual user program probably does something like:
PQconnectdb("host='myhost' dbname='mydb' user='myuser' password='s'");
FIRST POINT:
------------
the resulting executable program must be --x--x--x so that the users
using it
cannot read the binary and thus cannot see the password. that should be
in the documentation! programmers must not forget this issue!!
SECOND POINT:
-------------
if the user runs the program with the environment variable PORT set to
23423, he can install his own program on that port listening for the
password! he can then use that password to connect to the real database
and delete everything.
the two POINT must be documentated. a fix for the first point is not
neccessary. but a fix for the second point cannot be done due to
backward compatibility. ALL environment variables should be ignored.
there should be a "mkoptions_from_environment" function that has to be
explicitly called.
the environment stuff is like a second way into a function. not clean
design. i.e:
printf("hello");
does not print hello, but prints "goodbye" instead because the
environment sais so. i don't like the idea in general.
the documentation must say that one has to specify the port even if it
is the default port, because otherwise the database password can be
stolen.
but really there must be documentation on the issue!!
not all apps are web based. there are still native programs floating
around that are called by ordinary users...
cu
erik
--
Erik Thiele
email: [EMAIL PROTECTED]
---------------------------------------
Received: (at 184566-done) by bugs.debian.org; 21 Sep 2005 22:43:42 +0000
>From [EMAIL PROTECTED] Wed Sep 21 15:43:42 2005
Return-path: <[EMAIL PROTECTED]>
Received: from box79162.elkhouse.de [213.9.79.162]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1EIDJW-0008Iy-00; Wed, 21 Sep 2005 15:43:42 -0700
Received: from localhost.localdomain (unknown [195.227.105.180])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "Martin Pitt (workstation)", Issuer "piware CA" (verified
OK))
by box79162.elkhouse.de (Postfix) with ESMTP id 29159196379
for <[EMAIL PROTECTED]>; Thu, 22 Sep 2005 00:43:10 +0200 (CEST)
Received: by localhost.localdomain (Postfix, from userid 1000)
id C2A8A3413D; Thu, 22 Sep 2005 00:43:10 +0200 (CEST)
Date: Thu, 22 Sep 2005 00:43:10 +0200
From: Martin Pitt <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Re: security threat to postgresql applications
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="adJ1OR3c6QgCpb/j"
Content-Disposition: inline
User-Agent: Mutt/1.5.9i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-3.0 required=4.0 tests=BAYES_00 autolearn=no
version=2.60-bugs.debian.org_2005_01_02
--adJ1OR3c6QgCpb/j
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hi!
I close this bug report because the issues you mentioned are not
really relevant.
1) Hardcoding passwords in binaries is a really bad idea, this has
nothing to do with PostgreSQL in particular. Everybody who can execute
the binary is able to read the binary. Applications should usually ask
the user to input his/her password. Storing it in a configuration file
is also possible in some cases, but should be avoided; cases which
require remote authentication without actually typing in secrets
should be authenticated over Kerberos or SSL certificates.
2) Changing the default connection options in environment variables
is not security relevant at all, since usually programs specify their
connection options instead of relying to defaults.
Martin
--=20
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntu.com
Debian Developer http://www.debian.org
--adJ1OR3c6QgCpb/j
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDMeH+DecnbV4Fd/IRAlikAKDNbRQ5j8jUY7ayU+j5+ohSoYXQ3gCdEDzO
bJ9ubdY05jKVdd5xKmDe3s0=
=+ni9
-----END PGP SIGNATURE-----
--adJ1OR3c6QgCpb/j--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
