Re: Gnuplot qua Web-Service

[Jonathan T. <jt...@ae...>]

I wrote
| Even if you completely shut off gnuplot's ability to fork shells
| and run other commands, gnuplot is very likely not secure against
| malicious inputs.  That is, it is very likely that there exist malicious
| gnuplot command sequences that could trigger a buffer overflow, allowing
| the attacker to execute arbitrary code of her choosing in place of gnuplot.

On Sat, 30 Dec 2006, Daniel J Sebald wrote:
> I'm not following what you are saying.  Are you saying that gnuplot can plot
> some big files and hence overwhelm a system?  (Say, just the way my web
> browser with plug-ins will allow unlimited bloated, animated adverts and will
> slow the system to a crawl.)

Hmm.  That's true, but it's not what I was thinking of.  It's basically
a denial-of-service attack.


> Or are you saying gnuplot will lose track of
> some buffer that will overflow and a hacker could stuff a nasty program in
> there without the system knowing?

This is what I meant to imply.

That is, I am saying that unless someone has done a careful security
audit on the entire gnuplot source code (which I don't think is the case),
	[And maybe even if someone *has* done an audit
	-- audits can and do miss things!]
I think it very likely that there exists one or more bugs in gnuplot
which could be exploited (by malicious command and/or data-file input)
to cause the execution of arbitrary attacker-supplied code.

I emphasize that I am *not* suggesting that gnuplot is a particularly
flawed piece of software in this regard.  Rather, I'm simply saying that
Murphy's law suggests that just about *any* piece of software that's
big, complicated, written in C, and uses lots of dynamic data structures,
probably has a few exploitable buffer-overflow bugs lurking somewhere.


> We have been better at not allowing and
> ridding gnuplot of memory leaks.

Yes, this is clearly a good thing to do.  But I don't believe we're
going to fix 100% of these bugs any time soon.  We might well fix N%
for some large N which is still < 100, and that is a very good thing,
but I don't expect to get to 100%.

ciao,

-- 
-- "Jonathan Thornburg -- remove -animal to reply" <jt...@ae...>
   Max-Planck-Institut fuer Gravitationsphysik (Albert-Einstein-Institut),
   Golm, Germany, "Old Europe"     http://www.aei.mpg.de/~jthorn/home.html      
   "Washing one's hands of the conflict between the powerful and the
    powerless means to side with the powerful, not to be neutral."
                                      -- quote by Freire / poster by Oxfam