2

Earlier, I was messaged about a potential security risk in one of my projects. I checked it and found that it allows for "arbitrary code execution". (Quotes because it is running in a VM, but the damage that can be done is huge nonetheless)

Since it is an open source project, I imagine other people have found it and exploited it already. However, I am reluctant to fix it, because everybody will be able to see the commit and know about the exploit. Since I have no way of contacting the users and no way of forcing an update (updates are manual), I am at a loss at what to do here.

If I let it stay, people are going to exploit it. If I fix it, people are going to exploit it even more.

How can I proceed?

  • 17
    Uhh. Fix it now. Just the fact that you have to ask the question is troubling. – RibaldEddie Feb 3 '14 at 1:39
  • If you can't reach your users through the application itself, you should try to reach as many as possible through other communication channels, such as your website and support fora/lists. And tell them explicitly that this update fixes a security issue. If they are responsible users, that should be sufficient to get them to install the update. – Bart van Ingen Schenau Feb 3 '14 at 7:56
  • You don't have to publish a comment. You can fix it, and push other changes, and simple note the exploit was fixed in your release notes. Although if its being exploited what does it matter if more people exploit it? The only thing you should worry about is fixing it. – Ramhound Feb 3 '14 at 16:14
  • 1
    "Earlier, I was messaged about a potential security risk" - at least someone already knows about it. Just fix it. – davmac Feb 3 '14 at 16:28
  • Also: "Since I have no way of contacting the users and no way of forcing an update (updates are manual), I am at a loss at what to do here." Users of open-source software have at least some responsibility to keep their systems up-to-date; of course if they do so, and the providers haven't actually closed potential exploits, then it's pointless. Let the security holes present on users' systems be their fault, not yours. Fix it. – davmac Feb 3 '14 at 16:33
9

It should be up to users to ensure that they're running an up-to-date, secure version of your software - not fixing it in the hope that not quite as many people find out about it is not a good plan, IMHO.

Of course, you should make it as simple for users as possible to ensure they're running an up to date version of the software, so if there's no good way within your application to alert users of a new version or that their current version is insecure, then that's something I'd consider adding as a separate feature. However, the absence of this feature currently cannot be used as an excuse for not fixing major security holes.

|improve this answer|||||
  • I guess you have a point. I feel bad whatever I do, though. And yes, it has been in there for eternity. I originally took over that project from someone else and the code containing the exploit was not written by me. So it has been in there for at least a year. – Xandaros Feb 3 '14 at 1:44
  • @Xandaros Bugs and security holes are discovered in software all the time - that's life. As I've said already, I'd seriously consider writing some logic to ensure that in future you can notify users appropriately to avoid this in future - but in short, you should never feel bad about fixing an issue, especially a big one such as this! Leaving it untouched is another matter entirely though... – berry120 Feb 3 '14 at 1:47
  • I was not really considering leaving it in. I was more hoping for a smart way to fix it. But I guess there is no such thing :/ – Xandaros Feb 3 '14 at 1:48
  • 1
    @Xandaros The smartness would come in terms of seeing if you could manipulate what's already in the program to somehow give your users a warning about the hole at least - are there any server side requests to your end that you could manipulate for instance? Of course, the answer may well be no, but it's worth thinking about. If not, then just treat it as a learning curve as to why it's important to put these alert mechanisms in place at the earliest opportunity! – berry120 Feb 3 '14 at 1:51
0

Softwares are not perfect. Bugs are always there, just undiscovered. Even big websites suffer from simple attacks (Youtube script injection, etc).

Here are your scenarios:

  • Someone already knows about the security risk, and fortunately reported it to you.
  • It is also totally possible that other people also discovered the security hole and this person might not be friendly enough to report it to you; heck, he might even or already had exploited it.

Also, have you checked which version the security hole appear? It is possible that it's there for a long time already (if it is, see point #2).

TL;DR You're being too irresponsible here and you should fix your program.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.