Edit: Yes, I know this is a dupe. I've been told many times in short order. I did do a search before posting... but I searched on the URL of the story, and that did not turn up any threads.

I'm a Perl programmer in a Java shop. I've been making some inroads here. The boss has been pretty impressed with my work in Perl. But today one of my colleagues circulated this story, written by somebody who obviously has a dim view of Perl to begin with. My first thought was, "Is this news? This sounds like the sort of thing that taint checking was invented for."

So I give you the story for your reading pleasure, and ask for feedback from those more knowledgable than myself. Is he simply talking about taint? Is this as serious as he makes it out to be?

--
Random Synapse Firing

Replies are listed 'Best First'.
Re: New Perl Vulnerability?
by tirwhan (Abbot) on Dec 08, 2005 at 16:30 UTC

    There have been various threads on this issue over the past few days This one probably contains the most meat and least flaming muck. Opinions are currently divided between this being the end of the world and it not being a big deal at all :-).

    There is a bug in perl which can be used to compromise a machine if a script uses format strings incorrectly. This is a serious bug and if you suspect a script of yours may be vulnerable you should check. Work is underway to fix this in perl itself, the webmin script which exposed this hole has already been fixed (which does not help other vulnerable scripts of course). Taint checking will not help with this, but common sense on the part of the programmer will.

    Oh, and if your java buddies give you a hard time over this ask them to make a comparative list of the number of serious Java and Perl vulnerabilities over the last year. I suspect you won't hear back from them ;-).


    Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it. -- Brian W. Kernighan
[reply]
Re: New Perl Vulnerability?
by mulander (Monk) on Dec 08, 2005 at 16:10 UTC
[reply]
Re: New Perl Vulnerability?
by bluto (Curate) on Dec 08, 2005 at 21:39 UTC
    Is this news? This sounds like the sort of thing that taint checking was invented for.

    From the article:

    You can get something up and running quickly. Presumably, if it's not a one-time type program, you should polish it up afterwards, adding things like error checking and security checks but, shocking as it might seem, this doesn't always happen.

    I.e. poor programmers can write bad code -- no big deal. Or how about ...

    In fact, from my own experience digging around Perl programs, they're among the sloppiest and most unreadable programs out there.

    It's almost as if he's arguing that Perl programs just accumulate syntax trash, no matter how well meaning the programmer was. This is not a flaw of the language.

    Update: Removed inflammatory stuff. I know better than to write posts immediately after attending a funeral :-(

[reply]
      FD had a reference to just Ubuntu. I'd be keen to know exactly what the sitution is here in general - although maybe we will have to wait on a POC.
[reply]
Re: New Perl Vulnerability?
by Perl Mouse (Chaplain) on Dec 08, 2005 at 16:11 UTC
    Taint checking would not catch this. This may change in 5.10. That's a long time from now.
    Perl --((8:>*
[reply]

Back to Meditations