From b8bb53a2dc2ebe40322a0f29f174a5076f947d66 Mon Sep 17 00:00:00 2001 From: mdz Date: Thu, 12 Jun 2003 12:59:15 +0000 Subject: [PATCH] Misc. clarifications and additions to the section on security bugs Deprecate security uploads to stable, and point to the security instructions instead git-svn-id: svn://anonscm.debian.org/ddp/manuals/trunk/developers-reference@2318 313b444b-1b9f-4f58-a734-7bb04f332e8d --- developers-reference.sgml | 100 +++++++++++++++++++++++--------------- 1 file changed, 61 insertions(+), 39 deletions(-) diff --git a/developers-reference.sgml b/developers-reference.sgml index ea0d883..2749638 100644 --- a/developers-reference.sgml +++ b/developers-reference.sgml @@ -6,7 +6,7 @@ %commondata; - + - What to do when you learn of a - security problem -

+

When you become aware of a security-related bug in a Debian package, whether or not you are the maintainer, collect pertinent information -about the problem, and promptly contact the security team at -&email-security-team;. -Useful information includes, for example: +about the problem, and promptly contact the security team at +&email-security-team; as soon as possible. Useful information +includes, for example: What versions of the package are known to be affected by the @@ -2152,7 +2153,11 @@ Useful information includes, for example: especially helpful) Any fixed packages that you have prepared yourself (send only - the .diff.gz and .dsc files) + the .diff.gz and .dsc files and read first) + + Any assistance you can provide to help with testing (exploits, + regression testing, etc.) Any information needed for the advisory (see ) @@ -2162,9 +2167,12 @@ Useful information includes, for example: Confidentiality

Unlike most other activities within Debian, information about security -issues must sometimes be kept private for a time. Whether this is the +issues must sometimes be kept private for a time. +This allows software distributors to coordinate their disclosure in +order to minimize their users' exposure. Whether this is the case depends on the nature of the problem and corresponding fix, and whether it is already a matter of public knowledge. +

There are a few ways a developer can learn of a security problem: @@ -2180,27 +2188,28 @@ There are a few ways a developer can learn of a security problem: possible options for dealing with the problem: - if it is a trivial problem (like insecure temporary files) - there is no need to keep the problem a secret and a fix should be - made and released. + If the security exposure is minor, there is sometimes no need + to keep the problem a secret and a fix should be made and released. - if the problem is severe (remotely exploitable, possibility to - gain root privileges) it is preferable to share the information with + If the problem is severe, it is preferable to share the + information with other vendors and coordinate a release. The security team keeps contacts with the various organizations and individuals and can take care of that.

- In all cases if the person who reports the problem asks to not - disclose the information that should be respected, with the obvious - exception of informing the security team (make sure you tell the - security team that the information can not be disclosed). + In all cases if the person who reports the problem asks that it not + be disclosed, such requests should be honored, with the obvious + exception of informing the security team in order that a fix may be + produced for a stable release of Debian. When sending confidential + information to the security team, be sure to mention this fact.

-Please note that if secrecy is needed you can also not upload a fix to -unstable (or anywhere else), since the changelog and diff information -for unstable is public. +Please note that if secrecy is needed you may not upload a fix to +unstable (or anywhere else, such as a public CVS repository). It is +not sufficient to obfuscate the details of the change, as the code +itself is public, and can (and will) be examined by the general public.

There are two reasons for releasing information even though secrecy is @@ -2210,27 +2219,34 @@ or exploit has become public. Security Advisories

Security advisories are only issued for the current, released stable -distribution, not for testing or unstable. When released, advisories +distribution, and not for testing or unstable. When released, +advisories are sent to the &email-debian-security-announce; + mailing list and posted on . Security advisories are written and posted by the security -team. However they certainly do not mind if a maintainer can supply -some of the information for them, or write part of the -text. Information that should be in an advisory includes: +team. However they certainly do not mind if a +maintainer can supply some of the information for them, or write part +of the text. Information that should be in an advisory includes: A description of the problem and its scope, including: The type of problem (privilege escalation, denial of service, etc.) + What privileges may be gained, and by whom (if any) How it can be exploited Whether it is remotely or locally exploitable How the problem was fixed + + This information allows users to assess the threat to their systems. + Version numbers of affected packages Version numbers of fixed packages Information on where to obtain the updated packages + (usually from the Debian security archive) References to upstream advisories, identifiers, and any other information useful in cross-referencing the vulnerability @@ -2240,16 +2256,17 @@ text. Information that should be in an advisory includes: Preparing packages to address security issues

One way that you can assist the security team in their duties is to -provide fixed packages suitable for a security advisory for the stable +provide them with fixed packages suitable for a security advisory for +the stable Debian release.

When an update is made to the stable release, care must be taken to avoid changing system behavior or introducing new bugs. In order to do this, make as few changes as possible to fix the bug. Users and administrators rely on the exact behavior of a release once it is - made, so any change that is made might break someone's system. - This is especially true of libraries: make sure you never change the - API or ABI, no matter how small the change. + made, so any change that is made might break someone's system. This + is especially true of libraries: make sure you never change the API or + ABI, no matter how small the change.

This means that moving to a new upstream version is not a good solution. Instead, the relevant changes should be back-ported to the @@ -2260,8 +2277,8 @@ Debian security team may be able to help. In some cases, it is not possible to back-port a security fix, for example when large amounts of source code need to be modified or rewritten. If this happens, it may be necessary to move to a new -upstream version. However, you must always coordinate that with the -security team beforehand. +upstream version. However, this is only done in extreme situations, +and you must always coordinate that with the security team beforehand.

Related to this is another important guideline: always test your changes. If you have an exploit available, try it and see if it @@ -2284,6 +2301,11 @@ When packaging the fix, keep the following points in mind: stable release, this is oldstable-security. Do not target distribution-proposed-updates! + Make descriptive, meaningful changelog entries. Others will + rely on them to determine whether a particular bug was fixed. + Whenever possible, include an external reference, preferably a CVE + identifier, so that it can be cross-referenced. + Make sure the version number is proper. It must be greater than the current package, but less than package versions in later distributions. If in doubt, test it with dpkg @@ -2308,7 +2330,7 @@ When packaging the fix, keep the following points in mind: normal archive, otherwise it is not possible to move the security fix into the main archives later. - Be sure, when compiling a package, to compile on a clean + Be sure to build the package on a clean system which only has packages installed from the distribution you are building for. If you do not have such a system yourself, you can use a debian.org machine (see ) @@ -2318,7 +2340,8 @@ When packaging the fix, keep the following points in mind: Uploading the fixed package

-DO NOT upload a package to the security upload queue without +DO NOT upload a package to the security upload queue +(oldstable-security, stable-security, etc.) without prior authorization from the security team. If the package does not exactly meet the team's requirements, it will cause many problems and delays in dealing with the unwanted upload. @@ -2353,7 +2376,6 @@ installed on security.debian.org as well as the proper distribution-proposed-updates on ftp-master or in the non-US archive. - Moving, removing, renaming, adopting, and orphaning packages -- 2.30.2