Small hold-up with oav-virussignatures (security fixes needed)...

[Matthew Grant <grantma@anathoth.gen.nz>]

Brain,

Even though I am a gun /bin/sh programmer, even I run into ts limitations.  This oav-update  needs to be done in Perl, not /bin/sh due having to unpack untrusted zip files and manipulate the filenames within....  

It is too easy for malicious filenames to be buried in a trojan zip or .jar archive.  Signing a .jar archive (like the .credo files) does not prevent the addition of other unsigned files, as the signature is only on the files in the archive, not the archive container itself...

I have all the core functionality implemented, so it is just a question of replicating it in Perl in taint mode, and calling programs like find in such a way that no filename data out of the archive is used in the command arguments.  The taint checking will help flush it all out properly.  

I have to do this, as /bin/sh is not something you generally want to use in e-mail backends due to the problems with e-mail content and addresses too easily becoming executable data....

I will get back to you after the weekend with a .deb with the new script in it.

Best regards,

Matthew Grant

-- 
===============================================================================
Matthew Grant	     /\	 ^/\^	grantma@anathoth.gen.nz      /~~~~\
A Linux Network Guy /~~\^/~~\_/~~~~~\_______/~~~~~~~~~~\____/******\
===============================================================================

Attachment: signature.asc
Description: This is a digitally signed message part