Slashdot Mirror

How so? What I said is exactly that. On an unformatted disk you get three options, 1- use the whole disk, 2- custom partiton, and.. wait. there's only two.

I can't figure out what I mean by me over simplifying it because that's what it is, simple.

You word it so that the Windows partitioning step looks like it involves more steps than the Ubuntu stage, when both systems have a partition stage. You even have the user create a new partition for some reason when their disk is most likely already partitioned, and all they have to do is press Enter.

I did that because Ubuntu comes with Office software already on the disk.

You do realise that people use office software don't you?

Again (since you're being purposely obtuse), you cite Ubuntu's inclusion of OpenOffice as an advantage while pretending that versions of Office don't already come preinstalled on PCs or even on the OEM Windows recovery install disc included with the PC. Dell even has a CD with an app that lists all the bundled applications available, and you can just click their names. OpenOffice is also a free download for Windows.

This is nonsense, how can you do a fair comparrison of installing the operating system on a custom pc and come up with "the vendor disk".

Why wouldn't I? What is unfair about pointing out that Windows almost always comes with Office as well? And if it doesn't, OpenOffice is a free download for Windows too. I really don't see the point is of even bringing it up as an advantage.

It's totally irrelevant anyway because it's still not a click install even with the vendor disk. Which was my whole point in the first place.

There's no such thing as a "click install," especially with Linux.

Yes because it would be irresponsible not to download updates for Windows. It's so important that your box can get owned in less then 4 minutes.

Ubuntu never has security problems. Ever.

Ok, I will take a last shot - Explain to me why on the "Sandboxed" iPhone 2 OS Safari can be still be exploited to execute *arbitrary* code - http://support.apple.com/kb/HT3129 ?

Because no sandbox is 100% free of ways to get out of it.

As noted, that goes for Java too.

If the Java application was vulnerable and some malicious hacker causes the instruction to execute native code be loaded - its just going to be caught by the Virtual CPU as VM policy violation and you will get a nice permission denied type exception dialog.

That's very naive. That's what normally happens but as noted, there are ways around that just as with any system, to exploit flaws in the VM itself.

Sandboxes are great but any system must take a defense in depth approach, because you cannot rely on one system only like VM sandboxing) for security restrictions.

Let me just point out, you can use an apple PC without running quicktime OR safari.

And Since it's based off FreeBSD, there are really easy ways to harden the OS against exploits, like with any unix or unix-a-like OS variant. (like chflag aka chattr on linux)

and if you REALLY want to harden an apple system there is Darwin.

I mean, at least someone with some common sense can add a nice layer of security for apple without adding anything more than a replacement for safari and removing quicktime.

For windows security you need to run vista, or have a hardware firewall to protect your XP machine... Is it just me or is an OS with 58 'unpatched' vulnerabilities not somehow worse?
http://www.frsirt.com/english/Unpatched-Microsoft-Vulnerabilities.php

I know the safari vulnerability is pretty serious, but is it not as equally serious as the ActiveX Control Dialog Box Security Bypass Vulnerability, that is still unpatched on XP? I mean think of the dancing bunnies problem of internet security, a dancing bunnies site could easily use the activex bypass to install malware, on millions of XP machines.

Now, don't get me wrong, *any* protection is obviously better than none

http://www.frsirt.com/english/advisories/2007/3182. More and latest vulnerabilities about microsoft

Dan Kaminsky has done some research into this. If you combine Flash with a DNS rebinding attack, interesting things can happen that wouldn't happen without Flash (which is to blame for a fire, the fuel or the air?).

Scary web threats (HTML version)
Scary web threats (Powerpoint)

How confident can we be that there are no more remote command execution vulnerabilities in the Flash player?

The designed security measures are only part of the puzzle when something is in the field.

Generally, the whole European Cybercrime Convention is very sad. I for one do not welcome our new data retention legislation overlords, they shall go to hell!

I think it's time for someone to found a new resistance movement leading us to the revolution that will not be televised. Anyone willing to apply for the job? No? Oh, you mean, because fighting is useless as we do not have any rights anymore protecting our privacy?

Right, I will be waiting for the Cybercrime Gestapo at my door, wait - someone's already

And another one from December.

Other than kernel 2.0.x (10+ years ago), has Linux ever had a kernel bug that was exploitable remotely?

1. Disable just the DirectAnimation Path ActiveX Control in the Registry, or
2. Modify the ACL of the actual file Daxctle.ocx to be more restrictive.

http://www.jcb-sc.com/qmail/guninski.html
http://secunia.com/advisories/10649/
http://secunia.com/advisories/15533/
http://www.frsirt.com/english/advisories/2005/0490
http://www.frsirt.com/english/product/3207
http://www.saintcorporation.com/cgi-bin/demo_full_ tut.pl?tutorial_name=Qmail_vulnerabilities.html&fa ct_color=doc&tag=

http://www.jcb-sc.com/qmail/guninski.html
http://secunia.com/advisories/10649/
http://secunia.com/advisories/15533/
http://www.frsirt.com/english/advisories/2005/0490
http://www.frsirt.com/english/product/3207
http://www.saintcorporation.com/cgi-bin/demo_full_ tut.pl?tutorial_name=Qmail_vulnerabilities.html&fa ct_color=doc&tag=

A critical vulnerability has been identified in Sendmail, which could be exploited by remote attackers or network worms to take complete control of an affected system. This flaw is due to errors in the "setjmp()", "longjmp()" and "sm_syslog()" functions that do not properly handle certain asynchronous signals, which could be exploited by remote unauthenticated attackers to execute arbitrary commands by sending specially crafted requests to the SMTP port.

This is the one that has been patched by Microsoft.

I guess you thought it's just not possible for there to be more than one hole per rendering engine, right?

Here's two examples

http://www.frsirt.com/exploits/20050207.ex_perl.c. php

... this one? http://www.frsirt.com/exploits/20051121.IEWindow0d ay.php

Nice to see Slashdot on the ball. I was reading this yesterday, not last week!

Microsoft Internet Explorer "Window()" Remote Code Execution Exploit

Bluetooth socket exploit
LSM exploit
uselib() exploit
stack growth exploit

Bluetooth socket exploit
LSM exploit
uselib() exploit
stack growth exploit

Bluetooth socket exploit
LSM exploit
uselib() exploit
stack growth exploit

As a same day several flaws were reported, classified as Moderate Risk: http://www.frsirt.com/english/advisories/2005/1789 'These could be exploited by attackers to bypass certain security restrictions or conduct spoofing and cross site scripting attacks.' 'An unspecified drag-and-drop error allowing unintentional file uploads.' How many security issues like this we'll see in the future. Bad boys are interested about Opera too.

This about:config method works in the newest Netscape 8.0.3.3 http://www.frsirt.com/english/advisories/2005/1691 too.

There is a separate advisory from FrSIRT with their severity level at http://www.frsirt.com/english/advisories/2005/1690 where they list Mozilla Firefox version 1.0.6 and prior, Mozilla Firefox version 1.5 Beta 1 and prior and Mozilla Suite version 1.7.1.1 and prior. Netscape 8 based to Firefox codebase is not immune: http://www.frsirt.com/english/advisories/2005/1691

There is a separate advisory from FrSIRT with their severity level at http://www.frsirt.com/english/advisories/2005/1690 where they list Mozilla Firefox version 1.0.6 and prior, Mozilla Firefox version 1.5 Beta 1 and prior and Mozilla Suite version 1.7.1.1 and prior. Netscape 8 based to Firefox codebase is not immune: http://www.frsirt.com/english/advisories/2005/1691

http://www.frsirt.com/english/advisories/2005/1690

Affected Products:
Mozilla Firefox version 1.0.6 and prior
Mozilla Firefox version 1.5 Beta 1 and prior
Mozilla Suite version 1.7.11 and prior

http://www.frsirt.com/exploits/20050811.MS05-039.c .php

Some googling shows:

http://www.frsirt.com/exploits/08202004.brutessh2. c.php

Still requires some additional effort, in getting a password database, and some additional functionality, but it seems to be easier than I thought.

I wonder where all those attacks are comming from. Somebody probably must be fairly sure he doesn't get prosecuted.

http://www.frsirt.com/english/advisories/2005/1066

FrSIRT Advisory : FrSIRT/ADV-2005-1066
CVE Reference : CAN-2005-1174 - CAN-2005-1175 - CAN-2005-1689
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-07-12

* Technical Description *

Multiple vulnerabilities were identified in MIT Kerberos, which could be exploited by remote attackers to execute arbitrary commands or cause a denial of service.

The first issue occurs in the MIT krb5 Key Distribution Center (KDC) implementation when processing specially crafted TCP/UDP requests, which could be exploited by an unauthenticated attacker to cause a denial of service or execute arbitrary code on the KDC host.

The second vulnerability is due to a double-free error in the "krb5_recvauth()" function, which could be exploited by an unauthenticated remote attacker to execute arbitrary code in the context of a program calling the vulnerable function (this includes the kpropd program which typically runs on slave Key Distribution Center hosts).

* Affected Products *

MIT Kerberos 5 version 1.4.1 (krb5-1.4.1) and prior

* Solution *

Upgrade to krb5-1.4.2 release :
http://web.mit.edu/kerberos/dist/index.html

Or apply patches :
http://web.mit.edu/kerberos/advisories/2005-002-pa tch_1.4.1.txt
http://web.mit.edu/kerberos/advisories/2005-003-pa tch_1.4.1.txt

* References *

http://www.frsirt.com/english/advisories/2005/1066
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-002-kdc.txt
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-003-recvauth.txt

* Credits *

Vulnerabilities reported by Daniel Wachdorf and Magnus Hagander

http://www.frsirt.com/english/advisories/2005/1066

FrSIRT Advisory : FrSIRT/ADV-2005-1066
CVE Reference : CAN-2005-1174 - CAN-2005-1175 - CAN-2005-1689
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-07-12

* Technical Description *

Multiple vulnerabilities were identified in MIT Kerberos, which could be exploited by remote attackers to execute arbitrary commands or cause a denial of service.

The first issue occurs in the MIT krb5 Key Distribution Center (KDC) implementation when processing specially crafted TCP/UDP requests, which could be exploited by an unauthenticated attacker to cause a denial of service or execute arbitrary code on the KDC host.

The second vulnerability is due to a double-free error in the "krb5_recvauth()" function, which could be exploited by an unauthenticated remote attacker to execute arbitrary code in the context of a program calling the vulnerable function (this includes the kpropd program which typically runs on slave Key Distribution Center hosts).

* Affected Products *

MIT Kerberos 5 version 1.4.1 (krb5-1.4.1) and prior

* Solution *

Upgrade to krb5-1.4.2 release :
http://web.mit.edu/kerberos/dist/index.html

Or apply patches :
http://web.mit.edu/kerberos/advisories/2005-002-pa tch_1.4.1.txt
http://web.mit.edu/kerberos/advisories/2005-003-pa tch_1.4.1.txt

* References *

http://www.frsirt.com/english/advisories/2005/1066
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-002-kdc.txt
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-003-recvauth.txt

* Credits *

Vulnerabilities reported by Daniel Wachdorf and Magnus Hagander

1. Send zillions of emails containing enticing links.
2. Watch as zillions of sheeple open said links with Internet Exploder.
3. Ensure your site is equipped with the IE exploit du jour.
4. Install keylogger, steal identity.
5. ??? [obligatory, but unnecessary - why not spend this time in Zen-like meditation contemplating the nature of suffering?]
6. Open anonymous delivery address using stolen identity.
7. Visit any shopping site via r00ted Windows box and stolen credit card number.
8. Profit!

More seriously, why not go and tell the Internet Exploder people to get their house in order. If enough people complain then maybe they'll actually release a patch. Remember, they haven't released a patch for these vulnerabilities for NINETY-SEVEN DAYS.

...and this only came out a couple days ago:

http://www.frsirt.com/english/advisories/2005/0525

Not everyone has the same cash and technical staff as a banking institution. Should we all just give up crypto? Maybe we should just give up on Linux, since it's already had too many kernel exploits for one year this year.

http://www.frsirt.com/exploits/

05.17.2005 : Linux Kernel 2.6.x "ioctl_by_bdev()" Local Denial of Service Exploit
05.11.2005 : Linux Kernel "binfmt_elf" Core Dump Local Buffer Overflow Exploit
04.09.2005 : Linux kernel 2.4/2.6 Bluetooth Socket Creation Local Root Exploit
04.04.2005 : Linux Kernel "AIO" Local Denial of Service Exploit (PPC64 and IA64 Arch.)
03.30.2005 : Linux Kernel 2.6.x Local Denial of Service Proof of Concept Exploit
03.22.2005 : Linux Kernel 2.6.11 "sys_epoll_wait" Local integer overflow Exploit
03.22.2005 : Linux Kernel 2.4.x / 2.6.x uselib() Local Privilege Escalation Exploit
01.17.2005 : Linux kernel i386 SMP race condition Local Root Exploit
01.13.2005 : Linux kernel i386 SMP race condition Proof of Concept Exploit

On the same page, you look for BSD systems (Free/Open/Net/Dragonfly) and see how many kernel exploits you find this beginning of the year.
Ooops. I guess we're going to have to trust the FreeBSD guy on this one.

AD CONSULTING
RCS Montpellier B 478 502 123
Nom commercial : K-OTIK SECURITY
Renseignements juridiques
Siège social 1B Boulevard Berthelot
34000 MONTPELLIER
SIRET 47850212300019
Forme juridique Société à responsabilité limitée
Capital social 10.000,00 EURO
Code activité 721Z - Conseil en systèmes informatiques
Immatriculation 08-09-2004
Nationalité France
Dirigeant(s) Associé-Gérant M. BEKRAR Chaouki
Dépôt légal 08-09-2004 Formation de société

Disable JavaScript, or disable the "Allow web sites to install software" option [Tools - Options - Web Features].

Why would anyone run routinely with "Allow web sites to install software" enabled ?

I haven't confirmed it myself, but this report says that firefox V1.03 is vulnerable to remote arbit. code execution.

It was the exposure of the NT security model to the masses and 600 million end users which highlighted its blind spots and weaknesses. Given the number of vulnerability reported in Linux/various Unix'es on daily basis, I doubt its so-called 'model' would do much better.

Mozilla Suite and Firefox "favicons" LINK Code Execution Exploit

Linux kernel 2.4/2.6 Bluetooth Socket Creation Local Root Exploit

It was the exposure of the NT security model to the masses and 600 million end users which highlighted its blind spots and weaknesses. Given the number of vulnerability reported in Linux/various Unix'es on daily basis, I doubt its so-called 'model' would do much better.

Mozilla Suite and Firefox "favicons" LINK Code Execution Exploit

Linux kernel 2.4/2.6 Bluetooth Socket Creation Local Root Exploit

Speaking of suid vulnerabilities, http://www.frsirt.com/exploits/20050123.fm-iSink.c .php is an exploit of the mrouter hole (an overflowable suid app in iSync) which allows local root access. Exploited in January, still unfixed in April.

Severity of course depends on how your system is used.

...thisbefore allowing their vendors to add more crappy conduits and then taking forever to fix their old root exploitable ones.