[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #17895 [Applications/Tor Browser]: Tor Browser Bundle installer subject to DLL hijacking
#17895: Tor Browser Bundle installer subject to DLL hijacking
-------------------------------------------------+-------------------------
Reporter: ericlaw | Owner: tbb-
Type: defect | team
Priority: High | Status:
Component: Applications/Tor Browser | needs_information
Severity: Major | Milestone:
Keywords: tbb-gitian, tbb-security, | Version:
GeorgKoppen201604, TorBrowserTeam201604 | Resolution:
Parent ID: | Actual Points:
Reviewer: | Points:
| Sponsor:
-------------------------------------------------+-------------------------
Changes (by gk):
* cc: boklm (added)
* status: new => needs_information
Comment:
Replying to [comment:16 anon]:
> Is this blocked on upstream NSIS 2.49, NSIS 3.x update, lacking dev
time, or something else?
Lack of dev time. We have been mostly busy with getting Tor Browser
switched to Firefox ESR45 and we restructured our Tor Browser team (we are
a bit smaller now and I am responsible for the team management stuff, now,
too).
What we need here is:
1) Cross-compiling NSIS
2) Making sure the resulting .exe files are still bit-by-bit reproducible
3) Making sure that these files are still working on all supported Windows
versions (XP - 10)
4) Making sure stripping the authenticode signature is still reproducible
Thanks for pointing out that this is not done within 5 minutes.
That said I agree with this being an important issue and I'd like to have
this fixed rather sooner than later. Ideally, before the 6.0 gets stable.
I looked a bit at 1) this morning with NSIS 2.51 but already that step is
failing badly for me: I took the cross-compiler we generate during our
Windows build and followed the sparse cross-compile documentation.
Starting the build just broke with
{{{
sh: 1: Syntax error: "(" unexepected
}}}
while compiling advsplash.c. I then tried to get the necessary help by
looking at the way Debian builds NSIS but that did not work either for me.
boklm: Is this something you would have time to look into?
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17895#comment:18>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs