1100043 - Updater doesn't validate signature

Status: RESOLVED DUPLICATE of bug 973933

(Firefox :: Untriaged, defect)

Description

[jvoss]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:33.0) Gecko/20100101 Firefox/33.0
Build ID: 20141113143407

Steps to reproduce:

mkdir marfuzz
tar xf ~/Downloads/firefox-33.0.3.tar.bz2
cd marfuzz/
cp -i ~/Downloads/firefox-33.0.3-33.1.1.partial.mar update.mar
okteta update.mar
# Set all bytes in the signature to 'A'
/usr/local/bin/firefox-33.1.1/updater ~/src/marfuzz/ ~/src/firefox/



Actual results:

Updater updated the firefox directory with the update.mar without checking its signature.


Expected results:

Updater should have failed validation and not modified the firefox directory.

Comment 1

[jvoss]

Attachment: This mar file deletes the contents of the firefox installation.

This attachment causes updater to delete the current Firefox installation. It is the proof of concept for this bug. It contains an invalid signature which is not checked.
Download this file and run the following in its directory:
mv rmrf1.mar update.mar
/path/to/firefox/updater "$PWD" /path/to/firefox/

Comment 2

[Robert Strong (they/them - no direct email)]

This bug demonstrates that mar signing isn't implemented on platforms other than windows yet and the bugs to implement mar are public so this isn't security sensitive.

Duping to bug where we are implementing mar signing for platforms other than windows.