Take the 2-minute tour ×
TeX - LaTeX Stack Exchange is a question and answer site for users of TeX, LaTeX, ConTeXt, and related typesetting systems. It's 100% free, no registration required.

I am wondering if texlive-full is bearing any security issues? Why everybody does trust it? Are they checked by anybody?

Thanks for helping and educating me on this point :)

share|improve this question
6  
Might be an idea to mention what you mean by texlive-full. In many cases, Linux users will not be using the TL provided by their Linux, since it is not updated at a good enough pace. That being said, I'm not aware of any security problems. There was an article a few years ago. But those problems was mostly MikTeX related (fixed in a week) and the other issues are deemed academic. –  daleif Sep 23 '13 at 11:27
1  
If you're worried about packages using \write18 to execute harmful code you can run tex with -no-shell-escape –  Nicola Talbot Sep 23 '13 at 12:03
2  
I wrote about the security issue @daleif is talking about in my blog: texdev.net/2010/04/25/tex-and-security. –  Joseph Wright Sep 23 '13 at 12:03
    
@NicolaTalbot Also noting that the standard settings are not to allow \write18, and easily checked in texmf.cnf for the paranoid. –  Joseph Wright Sep 23 '13 at 12:04
1  
show 2 more comments

4 Answers

TeX Live consists of a relatively small number of executable items and a large number of 'other things', principally LaTeX packages, fonts and documentation (PDF files). The standard settings for the binary part of the set up are 'cautious' about potential security risks in the (La)TeX parts of the system, but these are likely to be more theoretical than actual. To the best of my knowledge there has not been an attempt to send to CTAN, and thus to TeX Live, a LaTeX package which deliberately tries to use \write18 to cause trouble. The number of people who would be affected is very small, and it's extremely unlikely that a self-replicating approach would be successful. The binary parts of the system are of course of more interest in this regard, but again there are not to my knowledge any actual issues (though see Is luatex as secure as pdftex? for discussion on the affect of Lua scripting on security).

All of that said, there is no-one checking each CTAN upload for security fixes, and the TeX Live team take most of their material more-or-less directly from CTAN. As such, if you are looking for some form of 'assurance' on the code then you will have to find a downstream group doing the work. That I know of, Ubuntu do not do this, although you might be better asking on an Ubunut-specific site about that. Perhaps other operating system teams (most obviously OpenBSD) might do such work if they are very security-focussed, but again that is more about those systems than about TeX.

share|improve this answer
add comment

If you are paranoid enough, then you could download the complete source code, read it and the compile it yourself.

However, due to the fact, that most users are not computer scientists, we have to trust the developers of all software we use. In fact we have to trust the manufacturers of everything we do not build/program/make ourselves.

However, open source software provides you and the rest of the world with the source codes. So, the general idea is, that if there was any flaw in the software, it will be noticed and reported by somebody. With closed source software, there is no such thing.

share|improve this answer
    
Hello Dohn Joe, thank you for the reply. That is something I also do value on the open source software. What I doubt is that the texlive-full package for linux is used by enough users to disclose any bugs or malware? As I know many would just use the basic packages. Please correct me if I am wrong. –  Barbara Sep 23 '13 at 11:30
    
Who guarantees that there are no security risks in other big software packages? Nobody. However, I put more trust in software developed by the open source community than software made by big profit-hungry and user-data-hungry corporations. You can always go minimalist and install only the packages you really need. Then you avoid having packages on your machine that you don't ever use. –  Dohn Joe Sep 23 '13 at 11:44
1  
@user37113 Do you even know what texlive-full is? It is a meta package, that just instructs Ubuntu (and similar) so install a long list of texlive- packages. So asling whether texlive-full has any malware does not make sense. –  daleif Sep 23 '13 at 11:45
3  
As mentioned it is a meta package, it does not install anything on its own. It only instructs the system on which packages to install. You will have to check the packages that it lists, but on its own it does not install anything. Why down you just download the corresponding .deb and see for your self. I just did. –  daleif Sep 23 '13 at 11:59
2  
@user37113 'Most people' is a tricky term. Like many other 'serious' TeX users, I install TeX Live using the version from TUG, which includes everything that is in texlive-full but is more up to date. That probably applies to many other people active here, but that doesn't mean it's general for all TeX users. Most of the binaries are in a small number of packages: almost all of the TeX code is from CTAN, and that I know of there has not been a security-related dodgy uploaded in the time I've used TeX (~ 10 years). –  Joseph Wright Sep 23 '13 at 12:07
show 10 more comments

note that everything in tex live comes from ctan, one way or another.

there have, in my time as a ctan manager, been two notifications of virus "detection" on ctan. the first, back in the '90s, complained about a file whose name matched some known virus at the time; its contents were of course, entirely harmless.

the second was more recent, but again proved a false alarm.

i have heard that at least some people run virus scanners over a copy of the ctan stuff; those people don't report any issues to us.

in my opinion, there is no more than a minuscule chance of problems with tex code from ctan, provided that you're careful with any use of \write 18 to get data from outside tex. i've never heard of any problem reports, even from that (admittedly dodgy) facility.

share|improve this answer
    
Dear wasteofspace, it really a good news. But can you please tell me if all the texlive packages (texlive-full in linux) is checked by ctan/tug before a new version is released? –  Barbara Sep 23 '13 at 18:34
    
@Barbara They are not, but even if they were, it wouldn't really matter since they are not signed. You could never be assured that what you are downloading is actually what was checked. –  StrongBad Sep 23 '13 at 19:56
    
@Barbara: These "packages" come from some other source than CTAN/TUG; typically an operating system vendor. Please contact these sources. –  Martin Schröder Sep 24 '13 at 8:58
add comment

I believe the vast majority of TeX Live is devoted to fonts and macro packages. These are passive files that do not do anything and cannot be "run" and are therefore safe. There are a small number of executable binary files (e.g., pdflatex) and scripts (latexdiff) that are intended to do things and therefore can pose security risks. From this question of mine, I believe the binaries are built from source by the TeX Live team. This means that there is the additional chance that a malicious CTAN contribution that requires compiling will be caught by the CTAN team. All bets are off for scripts on the other hand. You should be wary when running esoteric scripts and binaries.

For packages, it is possible that a LaTeX file could load a package such that when compiled by pdflatex that it acts as malware. Running a new version of pdflatex, where \openout is sandboxed, without shell-escape enabled should reduce these risks. Again, for esoteric packages, you should take a look at what it does.

share|improve this answer
    
Dear Daniel, do I understand correctly, that I can relly install the sudo apt-get texlive-full without any doubt (it is the 2009 version on Ubuntu 12.04 LTS). Just runnig a TeX-Document/Template can be dangerous? –  Barbara Sep 23 '13 at 13:23
    
I would be willing to go out on a limb and say that installing a signed version of the texlive package is perfectly safe. Running any of the binaries or scripts, on the other hand, has the potential for bad things to happen. –  StrongBad Sep 23 '13 at 13:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.