Ubuntu
account-plugins package

several plugins use insecure http in account setup

Bug #1037169 reported by Jamie Strandboge
260
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Online Accounts: Account plugins
Fix Released
Undecided
Unassigned
Online Accounts: Account plugins 0.6
account-plugins (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Running a packet sniffer (tcpcump or wireshark would do) on traffic going to port 80 I discovered the following account-plugins are using http to fetch the login page when setting up an account:
- account-plugin-flickr
- account-plugin-sina
- account-plugin-sohu

As a result, these pages can be used in a MITM attack. Please adjust these to use an https url instead.

See original description

Related branches

lp:~ken-vandine/account-plugins/lp_1037169
Alberto Mardegan (community): Approve
jenkins (community): Approve (continuous-integration)
Diff: 18 lines (+3/-3)
1 file modified
src/flickr.vala (+3/-3)
lp:ubuntu/quantal/account-plugins
lp:account-plugins
Jamie Strandboge (jdstrand)
description: updated
Revision history for this message
Ken VanDine (ken-vandine) wrote :

I had already asked about sina and sohu, those require http. I don't know about flickr off hand.

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

If sina and sohu require http, then I suggest they be disabled or not in main (and therefore not installed by default).

As for flickr, it is connecting to yahoo and I know that GOA uses https with its yahoo backend.

Revision history for this message
Ken VanDine (ken-vandine) wrote :

The flickr API[1] says http, I tried patching it to use https and in fact got a 404 error.

1. http://www.flickr.com/services/api/auth.oauth.html

Changed in account-plugins (Ubuntu):
status: New → Invalid
Revision history for this message
Ken VanDine (ken-vandine) wrote :

nothing in main will depend on the sina or sohu plugins, but flickr likely will. It doesn't auth against yahoo, it has it's own oauth API.

Ken VanDine (ken-vandine)
Changed in account-plugins (Ubuntu):
status: Invalid → Confirmed
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Ok, I looked into this a bit more:
 * flickr only uses http to do the oath bits and delivers no html over http (it does that over https). However, http://www.flickr.com/services/api/misc.overview.html says that https://secure.flickr.com/services is a valid endpoint, so I would prefer to use that if possible
 * sino and sohu are both confirmed to deliver html over http. These should be disabled or universe only

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package account-plugins - 0.5-0ubuntu3

---------------
account-plugins (0.5-0ubuntu3) quantal; urgency=low

  * debian/patches/lp_1037169.patch
    - Use the secure end point for flickr (LP: #1037169)
 -- Ken VanDine <email address hidden> Wed, 15 Aug 2012 14:49:05 -0400

Changed in account-plugins (Ubuntu):
status: Confirmed → Fix Released
Ken VanDine (ken-vandine)
Changed in online-accounts-account-plugins:
status: New → Confirmed
assignee: nobody → David King (amigadave)
Revision history for this message
Sebastien Bacher (seb128) wrote :

(subscribing canonical-desktop-team rather than ubuntu-desktop to avoid spamming the ubuntu-desktop mailing list with bug comments)

Ken VanDine (ken-vandine)
Changed in online-accounts-account-plugins:
assignee: David King (amigadave) → nobody
milestone: none → 0.6
Revision history for this message
Alberto Mardegan (mardy) wrote :

Actually, sina seems to support https:

http://open.weibo.com/wiki/Oauth2

since this bug is already in released state, I filed a new one, just for the sina plugin:

https://bugs.launchpad.net/online-accounts-account-plugins/+bug/1038871

Alberto Mardegan (mardy)
Changed in online-accounts-account-plugins:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.