Re: [Gnu-arch-users] Possible get/signature verification vulnurability (race-condition)

[Ron Parker]

On Sat, 24 Jul 2004 22:44:12 +0200 (CEST), Karel Gardas
<address@hidden> wrote:
> 
> Hello,
> 
> I'm using tla1.2 and during some recent work where I have got MICO's main
> archive (now signed) from mico.org to my local host I have noticed this
> behaviour:
> 
> 0) command issued is: tla get address@hidden/mico--main--2.3
> 
> 1) at the first, archive is traversed and all signatures are verified --
> this results in many ``gpg: Signature made...\ngpg: Good signature
> from...'' messages
> 
> 2) after (1), tla found my base-0 revision, downloaded it and unpacked,
> i.e. message ``* from import revision: 
> address@hidden/mico--main--2.3--base-0''
> is printed.
> 
> 3) after (2) it normally continues with downloading and applying patches,
> messages:
> ``* patching for revision: address@hidden/mico--main--2.3--patch-1
> * patching for revision: address@hidden/mico--main--2.3--patch-2
> * patching for revision: address@hidden/mico--main--2.3--patch-3
> * patching for revision: address@hidden/mico--main--2.3--patch-4
> * patching for revision: address@hidden/mico--main--2.3--patch-5
> * patching for revision: address@hidden/mico--main--2.3--patch-6
> ..............''
> are printed.
> 
> The problem is: when attacker modifies patch file in archive between the
> time when patch file is verified and time it is actually downloaded, it
> will succeed and I will end with "corrupted" source tree.
> I would like to ask if my analysis of tla behaviour is correct, since I
> have just guessed it from the output and from wathing network graph
> monitor, but haven't looked into the sources for a proof of it.

When using GPG, I believe you have to be in possession of the signed
content before the signature can be verified. However, in the case of
arch, I believe it is the checksum that is actually signed not the
actual patch. So, I believe what you are seeing is, the checksum is
downloaded and its signature is verified. Then the patch is fetched
and checked against the checksum that has been determined to have a
valid signature, cf. libarch/pfs-signatures.c.

This is only a two-minute analysis, so I may be misinterpreting something.