NMRPipe - Revision history

Joel Hedlund (NSC) at 11:46, 20 April 2012

2012-04-20T11:46:45Z

Joel Hedlund (NSC) at 09:41, 20 April 2012

2012-04-20T09:41:13Z

Joel Hedlund (NSC) at 09:34, 20 April 2012

2012-04-20T09:34:59Z

Joel Hedlund (NSC): Created page with "{{software info |description=NMR spectroscopy data analysis suite |license=free |fields=Bioinformatics }} [http://spin.niddk.nih.gov/NMRPipe/ {{PAGENAME}}] is a {{#show: {{PAGENA..."

2012-04-20T09:34:48Z

Created page with "{{software info |description=NMR spectroscopy data analysis suite |license=free |fields=Bioinformatics }} [http://spin.niddk.nih.gov/NMRPipe/ {{PAGENAME}}] is a {{#show: {{PAGENA..."

New page

{{software info
|description=NMR spectroscopy data analysis suite
|license=free
|fields=Bioinformatics
}}
[http://spin.niddk.nih.gov/NMRPipe/ {{PAGENAME}}] is a {{#show: {{PAGENAME}} |?description}}.

== Availability ==
{{list resources for software}}

== Security considerations ==
This program has considerable security issues that need to be addressed if installed on a multiuser system. It is recommended to set the permissions on the install directory to 700 prior to install and until all issues are solved.

# NMRPipe installs with many files and directories globally writable and executable. This means that anyone with access to the system can replace these programs with malicious programs. For example, it is trivial to produce a malicious program (that for example sends your personal information and passwords to crackers.org) and then executes the original program so you will never notice anything has gone wrong. This can be fixed at install using for example <code>chmod -R o-w .</code> in the install directory.

# The nmrbin.linux9/nmrInit.com environment initialization script unnecessarily puts . first in $PATH, which means that all shell commands will be checked against matching files in the current working directory before execution, and if a matching executable is found, this program will be run instead. For example, it is trivial to construct a malicious program called cd, or ls, or ssh, or bruker, or any other command commonly used by NMRPipe users, and if an NMRPipe user happens to use any of these commands in a directory containing such a file, well see above for consequences. Notably, NMRPipe does not require or use this setting so it can (and SHOULD) be safely removed from nmrbin.linux9/nmrInit.com.

== Tips and tricks ==
# NMRPipe claims to require using (t)csh shell, but actually doesn't. It requires a handful of environment variables to be set, and these can be trivially copied from nmrbin.linux9/nmrInit.com csh script.

# NMRPipe claims to require nmrbin.linux9/nmrInit.com to be sourced from the user's ~/.cshrc file, but actually doesn't, so users shouldn't. Especially since sourcing an unmodified nmrbin.linux9/nmrInit.com introduces potential security holes (see [[#Security considerations]] above).

== License ==
{{show license}}

== Experts ==
{{list experts}}

== Links ==
* [http://spin.niddk.nih.gov/NMRPipe/ Official website]

@@ Line 12: / Line 12: @@
 This program has considerable security issues that need to be addressed if installed on a multiuser system. It is recommended to set the permissions on the install directory to 700 prior to install and until all issues are solved.
-# NMRPipe installs with many files and directories globally writable and executable. This means that anyone with access to the system can replace these programs with malicious programs. For example, it is trivial to produce a malicious program (that for example sends your personal information and passwords to crackers.org) and then executes the original program so you will never notice anything has gone wrong. This can be fixed at install using for example <code>chmod -R o-w .</code> in the install directory.
+# NMRPipe installs with many files and directories globally writable and executable. This means that anyone with access to the system can replace these programs with malicious programs. For example, it is trivial to produce a malicious program that sends your personal information and passwords to crackers.org and then executes the actual original program so you will never notice anything has gone wrong. This can be fixed at install using for example <code>chmod -R o-w .</code> in the install directory.
 # The nmrbin.*/nmrInit.com environment initialization script unnecessarily puts . first in $PATH, which means that all shell commands will be checked against matching files in the current working directory before execution, and if a matching executable is found, this program will be run instead. For example, it is trivial to construct a malicious program called cd, or ls, or ssh, or bruker, or any other command commonly used by NMRPipe users, and if an NMRPipe user happens to use any of these commands in a directory containing such a file, well see above for consequences. Notably, NMRPipe does not require or use this setting so it can (and SHOULD) be safely removed from nmrbin.*/nmrInit.com.

@@ Line 13: / Line 13: @@
 # NMRPipe installs with many files and directories globally writable and executable. This means that anyone with access to the system can replace these programs with malicious programs. For example, it is trivial to produce a malicious program (that for example sends your personal information and passwords to crackers.org) and then executes the original program so you will never notice anything has gone wrong. This can be fixed at install using for example <code>chmod -R o-w .</code> in the install directory.
-# The nmrbin.linux9/nmrInit.com environment initialization script unnecessarily puts . first in $PATH, which means that all shell commands will be checked against matching files in the current working directory before execution, and if a matching executable is found, this program will be run instead. For example, it is trivial to construct a malicious program called cd, or ls, or ssh, or bruker, or any other command commonly used by NMRPipe users, and if an NMRPipe user happens to use any of these commands in a directory containing such a file, well see above for consequences. Notably, NMRPipe does not require or use this setting so it can (and SHOULD) be safely removed from nmrbin.linux9/nmrInit.com.
+# The nmrbin.*/nmrInit.com environment initialization script unnecessarily puts . first in $PATH, which means that all shell commands will be checked against matching files in the current working directory before execution, and if a matching executable is found, this program will be run instead. For example, it is trivial to construct a malicious program called cd, or ls, or ssh, or bruker, or any other command commonly used by NMRPipe users, and if an NMRPipe user happens to use any of these commands in a directory containing such a file, well see above for consequences. Notably, NMRPipe does not require or use this setting so it can (and SHOULD) be safely removed from nmrbin.*/nmrInit.com.
 == Tips and tricks ==
-# NMRPipe claims to require using (t)csh shell, but actually doesn't. It requires a handful of environment variables to be set, and these can be trivially copied from nmrbin.linux9/nmrInit.com csh script.
+# NMRPipe claims to require using (t)csh shell, but actually doesn't. It requires a handful of environment variables to be set, and these can be trivially copied from nmrbin.*/nmrInit.com csh script.
-# NMRPipe claims to require nmrbin.linux9/nmrInit.com to be sourced from the user's ~/.cshrc file, but actually doesn't, so users shouldn't. Especially since sourcing an unmodified nmrbin.linux9/nmrInit.com introduces potential security holes (see [[#Security considerations]] above).
+# NMRPipe claims to require nmrbin.*/nmrInit.com to be sourced from the user's ~/.cshrc file, but actually doesn't, so users shouldn't. Especially since sourcing an unmodified nmrbin.*/nmrInit.com introduces potential security holes (see [[#Security considerations]] above).
 == License ==