[OSSA 2014-002] Possible timing attack against tempurl (CVE-2014-0006)

+2 looks good to me

For what verson of swift was the TempURL middleware introduced (assuming this vulnerability was introduced along with it)?

Looks like TempURL came in with Swift 1.4.6, which was released in Feb 2012.

Okay, so that means Essex from an integrated release perspective? In that case we're going to need stable/grizzly and stable/havana series tasks and backport patches.

That means create a backport for 1.8.0 (stable/grizzly) and 1.10.0 (stable/havana)

Patch for 1.10

Patch for 1.8.0

Proposed impact description:

----------------------------------------------------------
Title: Swift TempURL timing attack
Reporter: Samuel Merritt (SwiftStack)
Products: Swift
Affects: All supported versions

Description:
Samuel Merritt from SwiftStack reported a timing attack vulnerability in Swift TempURL middleware. By analyzing response times to arbitrary TempURL requests, an attacker may be able to guess valid secret URLs and get access to files that were only intended to be publicly shared with specific recipients. Only Swift setups enabling the TempURL middleware are affected.
----------------------------------------------------------

That impact description looks fine to me. Would it help at all (from a risk identification perspective) to point out that this exploit involves identifying objects at random, and so poses additional hurdles for any sort of targeted attack (needle in haystack situation)?

I think that yes, it would be helpful to mention that an object name must already be known in order to use this attack.

Also, the object's account must have a TempURL key set (X-Account-Meta-Temp-URL-Key or X-Account-Meta-Temp-URL-Key-2) in order for this to work; without that, there are no valid signatures at all, so no amount of timing analysis will help.

Patches all checkout for me. I didn't attempt a timing attack but the changes seem reasonable. +2

New version

----------------------------------------------------------
Title: Swift TempURL timing attack
Reporter: Samuel Merritt (SwiftStack)
Products: Swift
Affects: All supported versions

Description:
Samuel Merritt from SwiftStack reported a timing attack vulnerability in Swift TempURL middleware. By analyzing response times to arbitrary TempURL requests, an attacker may be able to guess valid secret URLs and get access to objects that were only intended to be publicly shared with specific recipients. In order to use this attack, the attacker needs to know the targeted object name, and the object account needs to have a TempURL key set. Only Swift setups enabling the TempURL middleware are affected.
----------------------------------------------------------

Thierry's updated impact description in comment #13 looks good.

Text looks good to me.

CVE requested

CVE-2014-0006

@John, Samuel: how about we set the coordinated disclosure date to Thursday, January 16th ? That gives us a few days to merge it and make it part of Swift 1.12.0

Thierry's plan is good +1

pre-OSSA sent
Proposed public disclosure date/time: Thursday, January 16, 1500UTC.

Reviewed: https://review.openstack.org/67185
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=754633988931e4095530f6b13389c254096eb485
Submitter: Jenkins
Branch: master

commit 754633988931e4095530f6b13389c254096eb485
Author: Samuel Merritt <email address hidden>
Date: Thu Jan 16 13:40:53 2014 +0100

    Use constant time comparison in tempURL

    Use constant time comparison when evaluating tempURL to avoid timing
    attacks (CVE-2014-0006).

    Fixes bug 1265665

    Change-Id: I11e4ad83cc4077e52adf54a0bd0f9749294b2a48

[OSSA 2014-002]

Reviewed: https://review.openstack.org/67186
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=b2c61375b3255486adb2900922a894dc7dad3c6d
Submitter: Jenkins
Branch: stable/havana

commit b2c61375b3255486adb2900922a894dc7dad3c6d
Author: Samuel Merritt <email address hidden>
Date: Thu Jan 16 13:44:23 2014 +0100

    Use constant time comparison in tempURL

    Use constant time comparison when evaluating tempURL to avoid timing
    attacks (CVE-2014-0006). This is the havana backport of the master
    patch.

    Fixes bug 1265665

    Change-Id: I11e4ad83cc4077e52adf54a0bd0f9749294b2a48

Reviewed: https://review.openstack.org/67187
Committed: https://git.openstack.org/cgit/openstack/swift/commit/?id=c0eed792a22865b280f99cbb79076fa7ad19fcbb
Submitter: Jenkins
Branch: stable/grizzly

commit c0eed792a22865b280f99cbb79076fa7ad19fcbb
Author: Samuel Merritt <email address hidden>
Date: Thu Jan 16 13:45:52 2014 +0100

    Use constant time comparison in tempURL

    Use constant time comparison when evaluating tempURL to avoid timing
    attacks (CVE-2014-0006). This is the grizzly backport of the master
    patch.

    Fixes bug 1265665

    Change-Id: I11e4ad83cc4077e52adf54a0bd0f9749294b2a48

Fix proposed to branch: feature/ec
Review: https://review.openstack.org/70442