This is a security issue. In some environments this is not allowed. All security
related data, the password being one example, are treated as transient in the
sense that after the data is used, it is destroyed. One issue that this
addresses is the paging of security related information into a page file. If the
location where the password is stored is not deleted then it is available to
other system users.
Whether the software/computer are trusted is not an issue addressed by a
'process'. If the process dictates what is to be done with transient but
sensitive data then the process specified procedure must be followed. If the
process allows exceptions for certain machines, then those machines are
excepted. We don't have to address the process.
art
________________________________
From: Dale McCoy <dalestan_at_gmail.com>
To: users_at_tortoisesvn.tigris.org
Cc: Annamalai <annamalai_at_collab.net>
Sent: Mon, April 11, 2011 1:38:20 PM
Subject: Re: Credentials held unencrypted in memory during runtime
> While we test a scenario we found the TortoiseSVN client application
> holds the username and password strings in clear text within the
> memory during runtime, The sensitive information (e.g. password) is
> loaded into a variable during the authentication phase. The variable
> is not cleared after the initial use. It is possible to extract the
> TortoiseSVN strings stored in memory and obtain a valid password.
>
> Please let us know is security issue fixed in the upcoming release.
Why is this a security issue? Do you not trust the software running on
your development machines? If not, why are you letting this untrusted
software run on a machine with access to your source code?
It is not impossible that this is an issue with the subversion
libraries, not TortoiseSVN. Can this issue be observed in the
command-line client?
Dale McCoy
------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2718956
To unsubscribe from this discussion, e-mail:
[users-unsubscribe_at_tortoisesvn.tigris.org].
------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2718959
To unsubscribe from this discussion, e-mail: [users-unsubscribe_at_tortoisesvn.tigris.org].
Received on 2011-04-11 22:58:45 CEST