Re: Perl Store-able objects

--===============5344621196874109884==
Content-Type: multipart/alternative; boundary=001a113db33e6048d9054bdf4dff

--001a113db33e6048d9054bdf4dff
Content-Type: text/plain; charset=UTF-8

Anyone have any feed back on what might be expected from me to address the
fact that mason is using Perl storable objects?

On Tue, Jan 31, 2017 at 11:05 AM, Hiram Gibbard <[email protected]> wrote:

> Hi All, This may not be a Mason issue, but I have a security report
> stating the following:
>
> "Your app no longer use any of the Perl Storable Object cookies (cn, dn,
> changetoken) to keep state or perform authentication actions.  However, the
> underlying Perl Mason application framework will still process the data in
> these cookies as Storable objects if they are included in user requests.
> As a result, it is still possible to trigger exploitation."
>
> *Remediation:   *Do not process any cookies in user requests as Perl
> Storable objects.
>
>
> Looking for any guidance, clarity, or theories on the statement (high
> level of just where to look or what is it I might look for in the code).
> This application was written a long time ago by someone else, and I'm just
> trying to keep it running.
>
>
> Thanks in advance,
>
>
>
> --
> Hiram Gibbard
> [email protected]
> http://hiramgibbard.com
>
>


-- 
Hiram Gibbard
[email protected]
http://hiramgibbard.com

--001a113db33e6048d9054bdf4dff
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Anyone have any feed back on what might be expected from m=
e to address the fact that mason is using Perl storable objects?</div><div =
class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Tue, Jan 31, 2017 a=
t 11:05 AM, Hiram Gibbard <span dir=3D"ltr">&lt;<a href=3D"mailto:hgibbard@=
gmail.com" target=3D"_blank">[email protected]</a>&gt;</span> wrote:<br><b=
lockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px =
#ccc solid;padding-left:1ex"><div dir=3D"ltr">Hi All, This may not be a Mas=
on issue, but I have a security report stating the following:<div><br></div=
><div><span style=3D"font-size:11pt;font-family:calibri,sans-serif;color:bl=
ack">&quot;Your app no longer use any of the Perl Storable Object
cookies (cn, dn, changetoken) to keep state or perform authentication
actions.=C2=A0 However, the underlying Perl Mason application framework wil=
l
still process the data in these cookies as Storable objects if they are
included in user requests.=C2=A0 As a result, it is still possible to trigg=
er
exploitation.&quot;</span></div><div><font color=3D"#000000" face=3D"calibr=
i, sans-serif"><span style=3D"font-size:14.6667px"><br></span></font></div>=
<div><p class=3D"MsoNormal"><b><span style=3D"color:black">Remediation:=C2=
=A0 =C2=A0</span></b><span style=3D"color:black">Do not process any cookies=
 in user requests as Perl
Storable objects.<span></span></span></p><p class=3D"MsoNormal"><span style=
=3D"color:black"><br></span></p><p class=3D"MsoNormal"><font color=3D"#0000=
00">Looking for any guidance, clarity, or theories on the=C2=A0statement (h=
igh level of just where to look or what is it I might look for in the code)=
. This application=C2=A0was written a long time ago by someone else, and I&=
#39;m just trying to keep it running.</font></p><p class=3D"MsoNormal"><fon=
t color=3D"#000000"><br></font></p><p class=3D"MsoNormal"><font color=3D"#0=
00000">Thanks in advance,</font></p><span class=3D"HOEnZb"><font color=3D"#=
888888"><p class=3D"MsoNormal"><font color=3D"#000000"><br></font></p><div>=
<br></div>-- <br><div class=3D"m_-8384477306014231388gmail_signature"><div =
dir=3D"ltr"><div>Hiram Gibbard<br><a href=3D"mailto:[email protected]" tar=
get=3D"_blank">[email protected]</a></div><div><a href=3D"http://hiramgibb=
ard.com" target=3D"_blank">http://hiramgibbard.com</a></div><div><br><div s=
tyle=3D"display:inline"></div></div></div></div>
</font></span></div></div>
</blockquote></div><br><br clear=3D"all"><div><br></div>-- <br><div class=
=3D"gmail_signature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><d=
iv>Hiram Gibbard<br><a href=3D"mailto:[email protected]" target=3D"_blank"=
>[email protected]</a></div><div><a href=3D"http://hiramgibbard.com" targe=
t=3D"_blank">http://hiramgibbard.com</a></div><div><br><div style=3D"displa=
y:inline"></div></div></div></div>
</div>

--001a113db33e6048d9054bdf4dff--


--===============5344621196874109884==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============5344621196874109884==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Mason-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mason-users

--===============5344621196874109884==--