Slashdot Mirror

One more example where @stake allows time to fix the issue before going public.....

This @stake advisory was published on July 12, 2002. Under the section "Vendor Response", it states that: "Vendor was notified of these issues on May 28, 2002."

That's pretty much a month and a half advanced notice before going public. Again, it appears that since Pingtel acknowledged their "accomplishment" with "a point by point response to the @stake advisory" they held off with the announcement. Granted, this is a completely different platform, different security implications, etc. But still, the signs point to someone throwing a temper tantrum and going very public very early, with subtle yet noticable allegations that the Apple security fix would require a $129 purchase.

The initial security advisories did include a "vendor response" section. Across the board that said "upgrade to 10.3", without any mention of a forthcoming patch for earlier releases.

That's the only thing that had Bugtraq up in arms: the lack of assurance that earlier versions would see a patch. And most of the people worried about that were worried because they want Apple to suceed as a Unix vendor, not because they want to see it crash and burn. (I don't know about the Slashdot comments, because I only read more than the highest rated couple of comments when I've got moderator points, but I'd guess that at least some of them were along the same lines.)

I don't know if it was merely a typographical oversight, or if Apple really didn't have any plans to release patches for earlier releases. In the first case they should have been more clear initially (and now they will), in the latter case they were making a huge mistake. I'm inclined to believe it's the former.

This is not the first time that Apple's security PR has been less than impeccable. They've rebounded pretty well each time, and I haven't seen them make the same mistake twice.

It's only reasonable to expect them to get harshly criticized, especially with Mac OS X: they're jumping from a very soft, easy-going market (desktop publishing and education) into an insanely security-conscious market (Unix enterprise servers). They're actually doing quite well, but there are still more entrance pains to come. The security community is, to an extent, xenophobic, and certainly disinclined to believe that a vendor with a relatively small amount of experience in the market can be relied upon to do the right thing. So Apple has to prove themselves a bit. So far, they're doing pretty well. It doesn't matter if you make mistakes like this, as long as you admit to them, patch things up, and then don't keep making them (hey Microsoft, you listening here?).

And Apple really is doing a good job: I've seriously considered bringing Mac OS X (and the related hardware) in as a replacement for aging Sun hardware running Solaris. Sun seems to be falling apart, and (especially with the G5) Apple seems to be a reasonable replacement in the mid-range compute + high I/O line of work without the vendor/service problems you get from Linux (which isn't so hot on the I/O front, since it's hampered by the IA32 architecture's crappy I/O design... other architectures don't matter, because Red Hat doesn't support them commercially).

That sounds like a Microsoft way of thinking. Leave the code we have the same, just have add-ons to protect that and add-ons to protect that.....

The core of Windows is so bloated by patches or quick fixes I was confused on the column on Linux Hacks. Maybe it was ment as not to go down the same path. But the code that seems to be quick fixes rarely breaks anything, only makes it better.

No code is perfectly secure and I don't expect worms and such to stop on any OS, IMHO I feel that security needs to be a vital part of Windows' thinking, if they want to keep their market share.

I have recently written an article for SecurityFocus on how mod_security can be used as part of a Apache reverse proxy: Web Security Appliance With Apache and mod_security

As others have pointed out, the security flaw is only applicable to OS X 10.3. 10.1 and 10.2 are not vulnerable, so no patch is required.

Recommendation:

1) Upgrade to Panther (Mac OS X 10.3).

Let me repeat. OS X 10.1 and 10.2 are not vulnerable

[...]

Indeed, the spin and dishonesty in the article is so severe, and the pro-Micorosoft bias in the (mis)reporting of the facts so obvious, that I'm surprised even Intel zealots would buy it outright, hook-line-and-sinker, without even a thought to the contrary.

[snip bunch of Apple-ologist stuff]

Let me repeat. OS X 10.1 and 10.2 are not vulnerable

[...]

Indeed, the spin and dishonesty in the article is so severe, and the pro-Micorosoft bias in the (mis)reporting of the facts so obvious, that I'm surprised even Intel zealots would buy it outright, hook-line-and-sinker, without even a thought to the contrary.

[snip bunch of Apple-ologist stuff]

Let me repeat. OS X 10.1 and 10.2 are not vulnerable

[...]

Indeed, the spin and dishonesty in the article is so severe, and the pro-Micorosoft bias in the (mis)reporting of the facts so obvious, that I'm surprised even Intel zealots would buy it outright, hook-line-and-sinker, without even a thought to the contrary.

[snip bunch of Apple-ologist stuff]

Actually you're claiming that tech report and CNET are lying without any prove or plausibility-argument and don't contribute anything to much more specific postings above which discuss Apple's policy and the probability of a patch for =10.2

No, these problems are already fixed in 10.3 . It's 10.2 (and maybe 10.1, I don't know) that are vulnerable.

That fact should speak to those saying "just give them a week, the bug was only found yesterday", too. The bugs were found quite some time ago if they are already fixed in 10.3. It's just that the group that found the bugs withheld them from public disclosure to give Apple some time to fix them.

Here are the bugtraq links to the specific vulnerabilities:

Arbitrary File Overwrite via Core Files
Systemic Insecure File Permissions
Long argv[] buffer overflow

If it is going to be Apple's policy to not provide support for previous operating systems from the day the new one comes out it is going to be very, very difficult for them to break into the enterprise world. Even Microsoft provides support for operating systems for a few years after the new one is released. Maybe if enough people submit a bug report Apple will do something about it.

Here are the bugtraq links to the specific vulnerabilities:

Arbitrary File Overwrite via Core Files
Systemic Insecure File Permissions
Long argv[] buffer overflow

If it is going to be Apple's policy to not provide support for previous operating systems from the day the new one comes out it is going to be very, very difficult for them to break into the enterprise world. Even Microsoft provides support for operating systems for a few years after the new one is released. Maybe if enough people submit a bug report Apple will do something about it.

Here are the bugtraq links to the specific vulnerabilities:

Arbitrary File Overwrite via Core Files
Systemic Insecure File Permissions
Long argv[] buffer overflow

If it is going to be Apple's policy to not provide support for previous operating systems from the day the new one comes out it is going to be very, very difficult for them to break into the enterprise world. Even Microsoft provides support for operating systems for a few years after the new one is released. Maybe if enough people submit a bug report Apple will do something about it.

Right now I just browse through packet storm and SecurityFocus. You'll see all sorts of expolits, some are patched and others not. Be creative with some of them and you'll see how a cracker/hacker can easily use them to break a system.

As a side note, I used to keep a track of just IE exploits at the Unpatched IE Vulnerabilities place but they closed for business.

and it can't possibly be harmful, like a PDF

and it can't possibly be harmful, like a PDF

"I wouldn't be surprised if there aren't a few honeypot pages in there too."

Just for reference, I believe the term is "Honeytoken." Slashdot has discussed them, if you are interested.

Security hole hits patched Internet Explorer
Microsoft Recalls Botched Browser Security Patch
MS security patch slows XP systems to a crawl
Microsoft withdraws faulty server patch
Microsoft replaces, broadens faulty Exchange patch
Microsoft fixes another faulty patch
Faulty Patch Leaves IE Open to Attack
More patching problems for Microsoft
Minor glitch in Win2K patch

There were 7 updates yesterday!

And none of those updates covered the RPC vulnerability, again! That's right the Microsoft RPC vulnerability that has already been patched twice is STILL vulnerable and an exploit exists. Word is that Microsoft has been informed but, as usual, no word from Microsoft yet. The notification was sent 10 days ago.

So much for 24 hour patches. On the other hand, I must admit that I have no desire to reboot my servers every 24 hours so, it's just as well that Bill isn't as fast as he says he is.

I wonder if they will actually fix RPC on the third attempt.

Security focus article on MP3 vuln

Wired article on the same...

http://www.securityfocus.com/bid

How many times in that list of recent vulnerabilities do you see Microsoft?

Not that I'm a Microsoft supporter in a major way, but still, what gives?

MOD PARENT UP!!!!

Actually, the first link should really point here.

Ripped from here and here and some mandrake forums. Earliest post appears in February of this year, but it may be earlier.

-Adam

Yes, my experience exactly! My VBScript kernel runs perfectly on a cluster of Windows 98 boxes, which are so stable that I'm using them as a support for the desk.

Linux is obviously a sham, written by weekend hackers, and frankly I'm surprised that the Apache team dared to steal the Microsoft-developed HTTP protocol for their IIS-alike so-called "web server". ... HEY!

IHTB!!

Back in 2001, Microsoft's Steve Lipner said that code "Review is boring and time consuming, and it's hard,". They don't seem to understand that many people get a lot of satisfaction in doing that. Many people look for things to post to bugtraq because doing so is *fun* for them.

Steve Balmer's recent statement about vulnerability researchers - 'I wish those people just would be quiet' - is downright silly. They are the biggest company on the block right now, and there's always going to be someone who wants to make the big corporation look silly. Microsoft needs to wake up to the fact that there will *always* be someone who is a) bored, and b) wants to make them look bad.

because the Kensington is a piece of garbage.

If you're going "headless" then the WFS-1 by Smart ID is the better way. Check out this SecurityFocus article to see why.

Give me a Linux PDA with kismet, wavemon and a Lucent gold PCMCIA card anyday (for 802.11b anyway).

Here is one. Just search for bind on securityfocus and you'll find more

Here is one. Just search for bind on securityfocus and you'll find more

I know that Valve aren't the greatest where security is concerned, But if you ask me, it serves them right for having such insecure systems.

I like many others have pre-ordered half-life2, but I'm seriously considering cancelling my order. If they can't grasp basic security proceedures, they don't deserve to be successful.

I love to know why a source code leak cost them four months? I could understand it if they lost a portion of the code.

I know that Valve aren't the greatest where security is concerned, But if you ask me, it serves them right for having such insecure systems.

I like many others have pre-ordered half-life2, but I'm seriously considering cancelling my order. If they can't grasp basic security proceedures, they don't deserve to be successful.

I love to know why a source code leak cost them four months? I could understand it if they lost a portion of the code.

I know that Valve aren't the greatest where security is concerned, But if you ask me, it serves them right for having such insecure systems.

I like many others have pre-ordered half-life2, but I'm seriously considering cancelling my order. If they can't grasp basic security proceedures, they don't deserve to be successful.

I love to know why a source code leak cost them four months? I could understand it if they lost a portion of the code.

I know that Valve aren't the greatest where security is concerned, But if you ask me, it serves them right for having such insecure systems.

I like many others have pre-ordered half-life2, but I'm seriously considering cancelling my order. If they can't grasp basic security proceedures, they don't deserve to be successful.

I love to know why a source code leak cost them four months? I could understand it if they lost a portion of the code.

I know that Valve aren't the greatest where security is concerned, But if you ask me, it serves them right for having such insecure systems.

I like many others have pre-ordered half-life2, but I'm seriously considering cancelling my order. If they can't grasp basic security proceedures, they don't deserve to be successful.

I love to know why a source code leak cost them four months? I could understand it if they lost a portion of the code.

I know that Valve aren't the greatest where security is concerned, But if you ask me, it serves them right for having such insecure systems.

I like many others have pre-ordered half-life2, but I'm seriously considering cancelling my order. If they can't grasp basic security proceedures, they don't deserve to be successful.

I love to know why a source code leak cost them four months? I could understand it if they lost a portion of the code.

I know that Valve aren't the greatest where security is concerned, But if you ask me, it serves them right for having such insecure systems.

I like many others have pre-ordered half-life2, but I'm seriously considering cancelling my order. If they can't grasp basic security proceedures, they don't deserve to be successful.

I love to know why a source code leak cost them four months? I could understand it if they lost a portion of the code.

I know that Valve aren't the greatest where security is concerned, But if you ask me, it serves them right for having such insecure systems.

I like many others have pre-ordered half-life2, but I'm seriously considering cancelling my order. If they can't grasp basic security proceedures, they don't deserve to be successful.

I love to know why a source code leak cost them four months? I could understand it if they lost a portion of the code.

The original article at SecurityFocus.

Um, yes, I read the fucking article. And other articles, like this one, which states that Lamo "spoke openly of his exploits to SecurityFocus reporter Kevin Poulsen, according to Christine Mohan, a spokesperson at The New York Times."

And then, sure enough, I went to SecurityFocus and found this article.

The man practically wrote his own arrest warrant, why is everybody crying about it? HE ADMITTED TO THE CRIME TO A JOURNALIST!

And here I thought Tru64 was dead.

-B

@stake, eeye, and iss have all agreed w/ microsoft not to release details of even potential exploits until the microsoft has had 30 days to "evaluate" them, leaving admins and the public unnecessarily exposed to vulnerabilities. This is completely unacceptable, and contrary to the scientific peer-review process of real science. If you know there's a problem, you speak out, suggest a fix, and hopefully the appropriate parties will be responsible enough to take action. Additionally, others have to be able to VERIFY and REPRODUCE findings, a critical part of *real* research. But microsoft's tactic is to force so-called security "research" companies (who are in it for money, not necessarily for altruistic research or making things more secure) into a lop-sided, biases "standards" NGO, the "Organization for Internet Safety" (OIS), which Microsoft is a member. (read this). What they are proposing is censorship, hiding information until they can find a fix, so that only the hackers will know what's broken. Talk about the fox guarding the hen-house!!!

Additionally, the director of research for @stake, Chris Wysopal, is effectively lobbying congress to give teeth to the OIS, and more power to microsoft and their buddies.

OIS = @stake, BindView, SCO, Foundstone, Guardent, ISS, Microsoft, NAI, Oracle, SGI, Symantec. sounds like the stone cutter's guild to me.

Eeye seems to be left out for obvious reasons, they oppose this secretive "research." Read eeye's Marc Maiffret's (chief hacking officer) thoughts on things to a congressional subcommittee here.

"windows corrupts, microsoft corrupts absolutely."

OpenSSH_3.4p1+CAN-2003-0693, SSH protocols 1.5/2.0, OpenSSL 0x0090609f

In the advisory on securityfocus, it says that the affected versions are "Portable OpenSSH versions 3.7p1 and 3.7.1p1" - so it seems that since it's not using the latest, hottest implementation, OS X is not affected.

Of course, I'm only guessing here...

OpenSSH_3.4p1+CAN-2003-0693, SSH protocols 1.5/2.0, OpenSSL 0x0090609f

In the advisory on securityfocus, it says that the affected versions are "Portable OpenSSH versions 3.7p1 and 3.7.1p1" - so it seems that since it's not using the latest, hottest implementation, OS X is not affected.

Of course, I'm only guessing here...

No. There was some talk--stemming, apparently, from this InFocus article on SecurityFocus--that a few federal laws, most of which were not intended to apply in this case or in anything similar to this case. There is no active movement, as far as I know, among out legislators to illegalize honeypots; rather, the question was whether other laws may unintentionally make honeypots illegal, the feeling being that attackers caught by such a honeypot might in turn sue their captors.

Symantec fully supports information sharing on
threats and vulnerabilities and believes it is an important tool for
consumers and IT professionals to gain a measure of early warning of
potential attacks.

It's probably worth pointing out that this discussion took place on Bugtraq, the Symantec-owned full-disclosure mailing-list, a few days ago. Apparently, this is more of a misquote than anything. See http://www.securityfocus.com/archive/1/337333.

I'm curious - what do you think of my suggestion for reducing the number of kids in virus writing? I know it would be very ambitious, and would need considerable effort and cooperation between a large number of ethical and talented professionals with no direct monetary gain to encourage such participation, but to me it seems like it might help. If such an alternative had been present in the late 80's and early 90's, I suspect I would have been interested.

I am posting this In reference to the recent Wired article which Richard Smith posted to this list. Symantec fully supports information sharing on threats and vulnerabilities and believes it is an important tool for consumers and IT professionals to gain a measure of early warning of potential attacks.

The Bugtraq mailing list, maintained as an independent entity under the SecurityFocus brand, remains one of the most respected and open sources for security information and early alerting by security professionals worldwide and full disclosure is *critical to the integrity of the Bugtraq community*.

With regards to cyber crime we need more and higher quality resources for law enforcement to work on computer forensics, and we need cooperation from government and industry to assist prosecutors in building cases against attackers.

Given the increase in the number of security threats and the availability of online tools we also believe that the industry should focus on training and educating todaya(TM)s youth about the ethics of computer crime and its affects and impact on victims.

These are not simply my words but also an official Symantec statement.

Cheers,
-al

Alfred Huger
Senior Director Engineering
Symantec Security Response

Overly Smug Guy is an idiot (who might as well be a bot for all the "value" he adds to discussions), agreed. But he could have at least posted these...

But, then again, these aren't flaws, are they? No... djb insists they are features.

Overly Smug Guy is an idiot (who might as well be a bot for all the "value" he adds to discussions), agreed. But he could have at least posted these...

But, then again, these aren't flaws, are they? No... djb insists they are features.

Seriously, I use Windows and OOo, and there isn't anything I can't do with them as far as I know.

Same here. I actually find Open Office more usable than MS Office. Open a document in MS Word, leave it open and untouched for 15 minutes, then try to close it out. It warns you that your changes have not been saved? Uhh... ok? I find that very annoying. It makes me feel like Word corrupted my document just by being open.

That fact aside, what do *most people* really need with MS Office that they can't get from some free alternative? Granted *most people* probably just pirated their copy of MS Office anyway so they don't care about the $300-$500 pricetag, but with software gaining online intelligence, those days are going to come to an end soon enough. So many programs check for automatic updates when you start them now. Now that people are good and use to that idea, the next phase is to have said software application verify that it was paid for.