ruby-dev

前田です。

IRCで、ゆうぞうさんに、ローカルユーザだったらプロセスIDや時刻は推測でき
るので、探索空間がかなりせまくなってしまうと指摘されました。
(random.cのseedも時刻とプロセスIDなので)

以下がゆうぞうさんの実証コードで、最大でも数十秒で破れるとのことです。

#!/usr/local/bin/ruby

require "cgi/session"
require "digest/md5"

cgi = CGI.new
sess = CGI::Session.new(cgi)
sess_id = sess.session_id

pid = $$
now = Time.now
d = String(now)
tv_sec = now.to_i

1000000.times{|tv_usec|
  srand(tv_sec ^ tv_usec ^ pid ^ 0)
  digest =

Digest::MD5.hexdigest(String(d)+String(rand(0))+String(pid)+"foobar")[0,16]
  if digest == sess_id
    p "OOPS!!"
    break
  end
}

で、対策を話していたのですが、

(1) ユーザにsrandしてもらう、あるいは"foobar"の部分を指定してもらう。
(2) /dev/urandomを使う。
(3) String(Time::now)の代りにString(Time::now.usec)を使う。

などが出たものの、眠くて正常な判断ができませんでした。

というわけで、とりあえずご報告だけしておきます。

-- 
前田 修吾

Thread

Prev Next

In This Thread

Prev Next

[#24013] loop{proc{}}でメモリリーク? — "U.Nakamura" <usa@...>

[#24019] [security] security hole was found on PuTTY — "H.Yamamoto" <ocean@...2.ccsnet.ne.jp>

[#24028] --disable-shared --with-static-linked-ext problems — IWATSUKI Hiroyuki <don@...>

[#24030] Process.daemon — Tanaka Akira <akr@...17n.org>

[#24032] RDtool標準添付希望 — Minero Aoki <aamine@...>

[#24034] bdb-0.5.0のtests/btree.rbでsegv — akira yamada / やまだあきら <akira@...>

[#24043] [BUG] openssl/x509name — Minero Aoki <aamine@...>

[#24051] k*bsd*-gnu — akira yamada / やまだあきら <akira@...>

[#24052] Uconv標準添付希望 — Kazuhiro NISHIYAMA <zn@...>

[#24055] IO#readpartial again — Tanaka Akira <akr@...17n.org>

[#24060] Zlib::GzipReader#ungetc causes crc error — Tanaka Akira <akr@...17n.org>

[#24061] StringIO#readpartial — Tanaka Akira <akr@...17n.org>

[#24063] can't make on Solaris9 — UENO Katsuhiro <unnie@...>

[#24070] Zlib::GzipReader#readpartial — Tanaka Akira <akr@...17n.org>

[#24072] SSLSocket#wait — GOTOU Yuuzou <gotoyuzo@...>

[#24073] SSLSocket#sysread block a whole process. — Tanaka Akira <akr@...17n.org>

[#24080] net/telnet.rb to use readpartial — Tanaka Akira <akr@...17n.org>

[#24081] to compile tcltklib (bcc32) — "H.Yamamoto" <ocean@...2.ccsnet.ne.jp>

[#24088] duplex I/O for tty — Tanaka Akira <akr@...17n.org>

[#24094] ruby-mode.elのバイトコンパイルでエラー — akira yamada / やまだあきら <akira@...>

[#24100] Re: CVS server — "Akiyoshi, Masamichi" <masamichi.akiyoshi@...>

[#24103] core dump with binding, eval, instance_eval and class variable — Tanaka Akira <akr@...17n.org>

[#24104] String#clear — Satoru Takabayashi <satoru@...>

[#24106] return value of Process.daemon — Tanaka Akira <akr@...17n.org>

[#24112] ruby/tk crashes on bcc32 — "H.Yamamoto" <ocean@...2.ccsnet.ne.jp>

[#24118] tcltk stubs — nobu@...

[#24134] Re: [ruby-cvs] ruby: * dir.c (free_dir): fix memory leak. reported by yamamoto — "U.Nakamura" <usa@...>

[#24137] warning: read buffer data lost — Tanaka Akira <akr@...17n.org>

[#24140] CGI::Session has security problem? — Takahiro Kambe <taca@...>

[#24143] ヒアドキュメント形式の外部コマンド実行時の不具合(mswin版)？ — OKADOME Junichi <tome@...>

[#24154] `str style command execution at safelevel 3 — SASADA Koichi <ko1@...>

[#24156] CGI::Session::FileStore should not use Dir::tmpdir — Shugo Maeda <shugo@...>

[#24158] CGI::Session::FileStore does not work if $SAFE >= 1 — Shugo Maeda <shugo@...>

[#24167] `asm' undeclared error — akira yamada / やまだあきら <akira@...>

[#24171] gc bug? — Andres Salomon <dilinger@...>

[#24174] 'undefined superclass' message are required? — SASADA Koichi <ko1@...>

[#24183] CGI::Session problem again — Shugo Maeda <shugo@...>

[#24190] StringIO#truncate — Tanaka Akira <akr@...17n.org>

[#24191] IO#truncate — Tanaka Akira <akr@...17n.org>

[#24198] Exception handling miss? — SASADA Koichi <ko1@...>

[ruby-dev:24183] CGI::Session problem again

Thread

In This Thread

[#24051] kbsd-gnu — akira yamada / やまだあきら <akira@...>