Slashdot Mirror
2.2.16 Kernel Released - Fixes Security Hole
gavinroy writes: "According to an e-mail I received from the kind folks at Sendmail, Inc., the Linux Kernel versions 2.2.15 and below have a SUID security flaw. "This problem will affect programs that drop setuid state and rely on losing saved setuid, even those that check that the setuid call succeeded." Sounds like a good reason to go 2.2.16 to me - grab it." The sendmail advisory is also online, as well.
2.1.x is bleeding edge? Then what is 2.3.x? Gushing edge? Seriously, 2.1.x dates back to 1998 . Isn't that enough time to find these kinds of bugs? Now I'm not trying to flame here but this bug has existed for almost 2 years without being noticed. How far back do we have to go to be assured? IANAC (I am not a coder).
Marc
I don't know what proverb you mean, but the closed source model is about security with obscurity! The open source model is the exact opposite. That's how we find and fix problems. In public. And that's what makes us faster!
After I got over my initial outrage (and head->wall slamming), I was actually laughing. The guy was most definitly just a script kiddie (using lames scripts to boot). Though I don't really know how he got in, my logs were intact as were the his shell history files, though the script did try to handle that, but bash keeps the current history in memory, thus rm .~/.bash_history doesn't work to well :). AFAICT, he only left some back doors (which I fixed), and this was after a pretty thourough check of my system (though I am definitly going to look into something like tripwire as not everything is in the rpm database).
Linux isn't perfect, but I am much more willing to trust it than OpenBSD just due to the number of eyes looking over the source.
Bill - aka taniwha
--
Leave others their otherness. -- Aratak
Yes, I know that bugs that are caused by design issues take weeks or months to test (hence the long 2.3.x cycle), but this is not one of those.
Bill - aka taniwha
--
Leave others their otherness. -- Aratak
That their World wide printing network is being infiltrated day in day out by a crack band of elite special forces ankle and ethernet biting Tele Tubbies fans! Fuck wit.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
If fp means 'fifth post', yes you're right.
But you probably meant 'first post'???
For female sysadmis: s/male pronouns/female pronouns/ (don't blame me, english sucks:)
Bill - aka taniwha
--
Leave others their otherness. -- Aratak
Why do you say the superuser concept is just plain foolish? I'm not disagreeing, just trying to understand.
In defense of sendmail, sendmail-related security advisories have always come through the sendmail-announce list. Some idiot decided it was good to post about the advisory on Slashdot, which is certainly not the right forum for these things. (This is why there are these advisory mechanisms) The sendmail team even had enough good judgement to wait until the Linux kernel team had a patch before announcing the existence of this exploit.
People are so quick to place blame on things. Just upgrade your damn kernel and be done with it.
I support an edu environment that uses NT Workstation 4 in classrooms. (under duress)
The only way we can keep out the l33t hackers is to apply polices that make the PC's very annoying to try to use. Even then with such crap fundamental design, students get in and wreak havoc.
BeSysAdm is just one example. If you can log on at all, you are administrator of that machine!
There are other utils that claim to get domain admin, but I would'nt dare run it for fear of getting fired from the fraidy cat management.
And L0phtcrack is just downright amazing!
Back Orifice anyone?
NT is shite.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
2.1 was bleeding edge and unstable. These versions are still unstable as they are old unstable versions. These versions won't get stable just because alot of time has past. You are obviously not a coder other wise you would realize just what kind of bug this is. As of late 2.1 and 2.2 linux allows finer control over permisions than other systems. This is good but it wasn't working just how it should. This bug could be exploited to get root if you already managed to exploit another bug in sendmail. If this bug wan't around you would get nobody. Big deal. If there is a bug in sendmail, That would be the bug to worry about anyway.
It has been statistically shown that helmets increase the risk of head injury.
Beg to differ. I was a VMS sysadmin in an earlier incarnation, and as a DEC customer I received warnings of security holes well before those holes became public knowledge. Quite often I received a patch in the mail, then a week or so later saw notices of the vulnerability hit the BBSes (the Internet not being the primary cracker media in those days). The problem with VMS was/is the excessive cost, not performance, reliability, or security.
As for IBM, they will patch problems if A) you have a support contract and B) you are extremely persistent. Case in point - in order to get TCP/IP for MVS (version 3 release 1) to work on my IBM mainframe (I've got 12 linux boxen too, so mainframe bashers can save their breath) we had to load 1549 software patches. That is not a typo. 1549 patches, and the LPD still doesn't accept a zero-length hostname field from an LPR (IBM insists that they are RFC-compliant on this issue, which is another rant entirely) despite the fact that many LPRs do not fill this field. I have to route Novell's LPRs through linux and dummy up a hostname field in order for MVS TCP/IP to print jobs submitted with the Novell LPR.
As for Microsoft, well, you're basically right. They try quite hard to patch the flaws, but since the design of their system is fundamentally screwed up (as, in some ways, linux is - the superuser concept is just plain foolish) it's an impossible task. They'd have to have thousands of developers with no profitability constraints to stay on top of the bugs. In other words, they'd have to be like linux or BSD.
--Charlie
What would you rather do, patch a known hole with something that purports to be a fix, or leave the whole thing open in a state that is known to be insecure?
Jeezuz fucking Christ!
Even if the patch does'nt fill the hole or creates another, there are thousands of programmer eyes out their looking at that hole and that patch, looking for problems. They find one, they fix it, they post it.
MS can't compare with that.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
Actually, I think you're the only person that brought up anything about the security of linux.
I/O Error G-17: Aborting Installation
so you have a problem because you felt this should have been kept ZUPER ZEEKRIT! (tm)?
if you can offer an internet-ready operating system that lacks any kind of security hole, i am listening. if not, FOAD.
Huh!?!?!?
Users mistakes!?!?!?
Hang on, someone sends you an email, you open it, it absoluetely fucking floors your email server and network bandwidth in the DoS process of mailing itself to 50 of your collegues and 50 of each of their collegues etc and you think that the user opening his fucking mail is the one at fault!?!?!?!?!?
If an email came to a Unix user with a nasty payload, the damage would most likely be limited to that users ~ files and email. In Windows that users whole HDD can be Mr.Sheen'ed faster than you can say "I'm clean!" and you network totally fucked over.
The poor bastards on the network with Unix and Mac boxes, etc are left with this slow arse connection because of some money hungry arsehole in Redmond.
Wake the hell up.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Why is the article pointing to a direct download link instead of the mirrors?
Why does Slashdot link directly to the main kernel.org server, and circumvent the absolutely massive set of mirrors that they have setup around the world to save bandwidth and time for everyone?
...
...
Go to http://www.kernel.org/mirrors/ and get the new kernel from there
Hrm, a multiplexor like the CPAN one would be quite cool for kernel.org as well
I did try reading between the lines, and you're right. There was nothing there but blank space.
I really wasted my time trying to read it, too. Although I have to say that I couldn't see any wool...
Well who are these guys then? They've been filing 8-K reports for three quarters now, but I can't find the quote anywhere.
-- the most controversial site on the Web
I saw "kernel" and "released" and got my hopes up that 2.4 was finished. Damn the man and his female consort.
"The further I get from the things that I care about, the less I care about how much further away I get." -Robert Smith
As a matter of fact, you got that precisely backwards: the Open Source Movement (or I should rather say: the thinking internet community) maintains: Security through obscurity never works. Why is this, do you ask? Because security bugs, like all others, will be found, and what you do not want to happen is, that all the nasty crackers and script kiddies know about the bugs and you don't.
True, this also means, that all the crackers and script kiddies will now know about this bug, but there is a fix. And if you don't want to have to spend time to fix it, fine, suit yourself, just don't come crying to daddy if someone hacks your machine to bits, because you were informed beforehand.
Security through abscurity has never worked, see M$'s Windoze for case in point.
Stefan.
`I was all fired up to write a big rant, but instead found apathy to be a more worthwhile solution.' --- Ashley Penney
The truth shall make you fret. (Ankh-Morpork tImes motto)
Sendmail are hardly helping
So it would have been better to just let the bug exist?
I suppose that's the Microsoft security model. Let bugs we *know* about to just go on until the next service pack and just hope that other people don't know about it. Bull. By the time that the power that be (Microsoft in the Windows world) know about a bug in the wild, people who look to exploit these things know and probably use it. Hence, the faster it is fixed, the better, even if it's done in public, since the people who would use it for harm probably already know about it.
A good example:
Back in January or so, a bug was known in Microsoft's Internet Exporer software that would cause a very hard computer crash. (If you must know, it involves following a link to "c:\con\con" or "c:\nul\nul" or "c:\aux\aux") It was patched about a month ago (May, I believe). If this had been Linux, I could have personally fixed it, the fix is so very easy (the hackish way would be to disallow those specific strings mentioned, the more complete would be to restrict links to old DOS functionality)
.. by the predictable responses from people here.
Linux is not secure!
Linux can't be trusted!
Well stop shouting and think for a minute. Security is not a simple subject and there is no such thing as a totally secure system. All you have is more secure systems and less secure systems. IMO, these are the important questions:
Q: Are security flaws like this easier to find in open source operating systems such as linux?
A: yes!
Q: Does this make linux more secure than closed source systems?
A: No!
Q: How many potential flaws exist in closed systems?
A: Nobody knows.
Q: How many more flaws will be found in linux:
A: Nobody knows.
Q: Is linux more secure or less secure than other systems?
A: There is no clear answer. Weigh up the pros/cons of the security records of each OS you are considering, and the areas in which they have had security problems and decide for yourself.
Please people, every time a flaw is found in Linux, people shout "Linux is not secure!" and when its in NT, we hear "NT sux. Linux rules"
and similar for other OS's. Stop it.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
So, what do you suggest ?
;-)
Do you really think that the Windows world is more suitable to business implementations ?
Well, if you have a massive support team busy following all the viruses, all the users complaints, all the Technet "pseudo-solutions", etc..., perhaps it is...
At least, here, we have already a solution... How many hours (or days) did you personnaly suffer from the I Love You virus ?
Did you see the code of this virus ? Do you know that it was so easy that even a 10 year old child could have been able to write this !
Perhaps is it more funny for 15 year olds to write viruses for Windows rather than following the mailing lists concerning Linux
More seriously, I don't think there's ONE good solution. But I'm certain Computer Science IS the business of "a whole team of professionnal". And an entire network can't be correctly managed by a few untrained people.
Moreover, I'm persuaded than following the security problems, the patches, the bugs, the evolutions, etc... is a great and interesting part of the job in IT. And, more important, it is necessary, whatever soft you're using. If you don't do this personnally or internally, at least you should have this done by someone else.
Computers don't run without problems, whatever OS is running... Bug-free softs don't exists, nowhere. And security problems are occuring since IT exists, and will continue to occur, whatever OS is used. Rather than complaining about these facts, why not finding long-term solutions and building an internal (or partly external, relying on competent external companies for example) IT department capable of following, anticipating and handling those problems efficiently ?
Sure it costs money, but remeber that all the business rely on IT. Everywhere. So that should normally be the first part of the budget... I personnaly still wonder why everyone seems to be persuaded that computers run alone without problems and that the IT department can be made of a few untrained guys with a very little budget. Why is the commercial department (for example) bigger than the IT one ? Same for the budgets ?
If someone has an answer, I'll be glad to discuss it.
Linux 2.2.16 Release Notes
/proc drivers failed to do correct sanity checking
Platforms:Alpha, PowerPC, S/390, Sparc, X86
Introduction
Linux 2.2.16 is the latest update to the Linux kernel tree. The out of the box tree supports the Alpha, PPC, S/390, Sparc and X86 platforms. MIPS ismostly merged but you should obtain the platform specific tree. ARM and M680x0 users should get their platform specific tree.
Compilers
This code is intended to build with gcc 2.7.2 and egcs 1.1.2. Patches for building with gcc 2.95 are merged but less tested than other compilers. Caution is recommended when using gcc 2.95 and feedback is sought.
Binary Compatibility
Linux 2.2.16 changes a few internal system structures. You may need to rebuild a few third party modules such as pcmcia-cs when upgrading from older kernels to this one.
Security Notes
Linux 2.2.16 is primarily a security release. It includes fixes for both local and network related bugs. Upgrading is strongly recommended.
Security Updates
Capabilities
Fixes for serious setuid handling flaws when using restricted capability sets
ELF loader
The ELF loader could be tricked by erroneous headers
Procfs
Several
Readv/writev
Potential overflow bug fixed
Signal Stacks
Exec failed to clear an existing alternate sigstack
System 5 Shared Memory
If a user managed to attach a segment 65536 times bad things happened.
TCP multiconnect hang
The TCP code had a bug that could cause the machine to hang. This was user exploitable.
Architecture Updates
Alpha
Fix SRM handling
Export symbols needed for modular tv card support
Fix SMP rescheduling with lock held
Handle early Monet boards
i386
Handle IBM thinkpad APM bios again
Attempt to work around broken BIOS MP1.4 tables
Interrupt controller hanging changed to handle possible buggy chipsets
In a few cases IRQ probing was fooled by longstanding pending IRQs
Detect and report Intel 'Cascades' series processors
Support processors over 4.3GHz in speed
MIPS
PowerPC
S/390
Resynchronized with the IBM code base. Multiple fixes.
IBM S/390 partition formats.
Sparc
Sparc64 OBP fixup fixes
Envctrl driver updates
Fix mishandling of some unaligned exceptions
Fix tlb flushing bug
Sbus audio fixes for poll()
Report correct errors on sunmouse errors
Core Updates
Elevator algorithm changes
The disk scheduling algorithm is now fair over short as well as long terms
Kmod
The module loader spots loops and acts sensibly if they occur
VM fixes
Improve the virtual memory subsystem behaviour
Driver Updates
Adaptec 152x
Recognize the AIC6370Q cards
ATI frame buffer
Fix PCI address handling errors
CDROM
Generic CD-ROM layer enhancements akin to 2.4test
CMPCI audio (CMPCI 83x8)
The SP/DIF output is now supported and a DMA bug fixed
Computone Serial
Updated to rev 1.2.9
Console
A memory scribble in the console driver has been cured.
CPiA Camera
Driver updates and fixes
Cyclades Serial
Report physical addresses, PLX9050 bug workaround, improved performance for TX on Cyclom-Y
Girbil dongle
A timing problem with some devices has been fixed
I2O Block
Support added for dynamic volume creation/deletion
I2O core
Fix several bugs in the core
IDE-CD
Remove the ghost DVD hack. DVD-RAM is now writable directly.
IDE-CD
Unified audio ioctls, packet interfaces using MMC2. Fix possible OOPS
IDE-CD
Add DVD ioctls needed for DVD movie players
IDE Disk
Handle drives jumpered for 4092 cylinders
IDE Disk
Avoid automatic DMA enables on the 450NX
IDE Probing
Fix a bug that sometimes caused CD-ROM or LS-120 probe errors
IDE
Recognize Simple Tech ATA Flash disks.
INI9100U
Handle shared IRQs
Intel ICH audio
A minimal driver for the i810 audio is now included.
ISDN
Fix multilink PPP problems
Keyboard
Handle PS/2 style reconnect code sequences.
Lp
Added more checks to careful mode
Maestro audio
Poll bugs have been fixed and a potential crash on unload.
MDA console
Fix cursor bugs
Parallel IDE
This now tries to autoload a protocol module
Parport
Add TIMEDIA 1889 support
PSS Audio
Joystick support sorted out, cleaned up code and more
RAM disk size limit
This is now configurable
Random driver
Remove key repeat codes from random entry pool - they are too predictable
SBC-60XX
A driver for the watchdog on this board has been added
SCSI CD-ROM
Removed the GHOST hack. SCSI DVD-RAM are now writable directly.
SCSI Disk Driver
Correct handling of disks with 4K block sizes
SCSI Generic
Updated to the current revision
Seagate SCSI
Recognize the IBM F1 V1.20 card
ServeRAID
Updated to the 4.0 driver
SyncLink
Updated to handle Synchronous PPP and Cisco HDLC
Trident 4DWave driver
New sound driver added. Also supports the SiS 7018 and ALI5451
TTY Layer
Return -EFAULT rather than ignoring invalid I/O requests.
VGA console
Disable the IRQ on the vga frame buffer
VIA 82cxxx
The driver now supports native mode audio.
Yamaha PCI Audio
A legacy mode driver has been added. An ALSA native mode driver is in progress.
File System Updates
Ext2fs
Fix a long standing but never observed bitmap handling bug
FAT
Clean up multibyte encoding handlers
ISOfs
Handle sessions better
NCPfs
Mixed updates
NFS
Fix potential machine hang in nfs_free_dentries
Partitions
Disks with old style partitions on large block sizes are now automatically recognized and handled.
SMBfs
Assorted updates, removal of debugging messages. POSIX unlink semantics
UFS
Fixed buffer leak on full disks
Miscellaneous Updates
Configuration
Both Menuconfig and Xconfig have been improved.
Gcc 3.x
Change compiler tests ready for when gcc 3.0 eventually appears
Network Updates
3c515
Fix a bug where the board hung after 2^32 packets
3c59x
Extensive updates and bug fixes to this driver. NWAY on the 3c590C
82596
Performance enhancements and more
Acenic
Updated to 0.44. Fixes for a crash sometimes seen with dhcp clients
Appletalk
Several cases where appletalk would oops on device downs have been fixed
C101
Added a synchronous driver for the Moxa C101
DGRS
Support shared IRQ mode. Handle gcc 2.95 builds
DHCP
DHCP is now supported on diskless boot
DMFE
Remove surplus error messages
EEpro
Add support for the older ee10 boards (82595FX etherexpress 10)
EEpro100
Workaround FCB interrupt lockups, clean up 82559ER support. Honour PortReset timing.
Hamachi
Driver for the Packet Engines GNIC-II added
IBM TR
The windowed shared ram is now supported in full
IP Masquerade
A memory scribble in the masquerade code has been fixed
IPX
Fix a memory leak in the IPX layer
IRDA
Fix for automatic bandwidth setting
Olympic TR
The IBM PCI adapters now work on LinuxPPC
Riscom N2
Support for the RISCom/N2 added. (not the integrated CSU/DSU)
SBE WanXL
Support for this has been added.
SMC9194
Fix board memory allocation bug.
SyncPPP
Added ioctls for changing flags
TCP
Fix a crash on certain unusual TCP retransmit patterns
Unix sockets
Provide credentials on socketpair()
RFC1925
Did I claim to be original with that? Of course, I could have written Mickey$choft Winddoos, but I rather doubt you speak Dutch.
Stefan.
The truth shall make you fret. (Ankh-Morpork tImes motto)
"Oh, we've found this huge gaping hole in the system, any scriptkiddie will immediately find it, once word gets round." 'Well, lets pretend it isn't there and try to find a fix before shit happens.' "Uhm, well, we really found out about it this morning, when the mail server was discovered to be hacked and truly messed around with." 'Well, let's just hope the little shit tells noone. So, not a word to anyone, right?' "You're the boss."
And if you think "Obscurity is one of the prime security features provided by firewalls" you've got some mightily funny firewalls where you live. Over here, their main function is to deny access, selectively, to some services and/or some machines. Or rather, to selectively allow access, because the remainder is denied.
You're right in that obscurity provides some level of security, but 1. you can't rely on it and 2. it only stops the really moronic/incompetent. So yes, I keep maintaining: "Security through obscurity never works". It can only lull you into a false sense of security.
Stefan.
The truth shall make you fret. (Ankh-Morpork tImes motto)
Funny how people always compare Linux with NT when there is a security bug in Linux.
Why not compare Linux with another opensource OS like, OpenBSD? *BSD, as far as I can understand, use a very cathedral like development model.
And then compare NT with a closed source OS, like Solaris.
Now, which one have given the more secure OS in their category?
And BTW, I thought that article on the developer's website showed that open source does not guarantee security nor that security bugs will be found?
Je ne parle pas francais.
Yea I agree with you completly. RealTek kinda pisses me off with their genericness. I've had great experience with the DEC Tulip chipset based cards. Very easily supported too. DOWN WITH REALTEK
- Hi I'm Linus Torvalds and I pronounce Linux, Lih-nix..
Don't underestimate the power of understanding exactly what's going on. The problem has just been announced. The fix is here now. What the fix involves is well documented. Sound anything like the release of an MS patch to NT?
I hope you're not suggesting a script run as root on a unix machine can't do damage. As I remember, the first 'worm' ever was developed for unix machines. Also, it's not OPENING your mail that triggers the worm. It's RUNNING the SCRIPT. This can also be done outside of the email. This is a classic case of users having more control then they can handle. Fix? Remove some control. I personaly would rather be allowed to run whatever I want out of my email but obviously this is too much for average sheeple to handle.
Any good encryption algorithm will still be effective, even if (and because) its algorithm is widely known; it will rely on 1) passwords or keys being kept secret by the users, and 2) hackers not having the computational power available to break in without the key.
Obscurity doesn't work.
Read my keyboard review.
You're assuming again there is a "hole" in VBScript. You're blaming the company for it's user's mistakes, when it works exactly how it's supposed to. Microsoft's "fix" for the "security hole" is to disable the running of VBS within mail so that it's uninformed users won't run attachments. I guess the next step is to disable the use of .exe's in the operating system.
If you want real stability and lack of problems, go for the last generation of kernel.
For production boxes, 2.0.X boxes are probably a good idea..
I read the release notes and kernel traffic and try to figgure out when the new series has matured, and this time it was mostly done about 2.2.12, but still had some ide problems and this bug.
Besides, you should ask a Solaris admin about the bugs that SUN patches months after they are widely known.
Blessed are the pessimists, for they have made backups.
If the AC actually understood such concepts they would have kept their mouth shut.
Perhaps we should set up a little program that would explain things to these children. Perhaps a cute little character. Maybe an animated paperclip?
This software is provided by the authors ``as is'' and any express or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a partiticular purpose are disclaimed.
In no even shall the authors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of damage.
Lars -
The advisory is unclear, just says versions before 2.2.16. Does this include 2.0.x? 1.2.x? even older versions?
-Yarn - Rio Karma: Excellent
> but also an attorney's license
I notice you didn't say anything about making the grade as a practicing attourney.
Mucking foron.
--
Sheesh, evil *and* a jerk. -- Jade
This bug is a part of the new capabilities functions. ;-)
All that is happening is that under some circumstances, SUID programs that try to drop some of their priviliges don't end up droping them correctly, and remain SUID.
This does not open up any more remote exploitable holes, but rather makes it give you root rather then your "nobody" user when you break a program like sendmail that uses this sort of security.
Is this a bug? Yes. Is it remote exploitable? No.
Not to mention, that as far as I know, quite a few other os's don't provide capabilities like this, so they are all as vulnerable as Linux is.. (However, I've never researched this and could be dead wrong, they could all have implemented this ages ago..
Blessed are the pessimists, for they have made backups.
BluePoint Linux Software Corp. is someone I've never heard about, hence I can only speculate. But the speculation is that it's either a distribution maker or a company that writes software to run on the Linux operating system.
Note that BluePoint Linux Software Corp. is no more the maker of Linux then VA Linux Systems or RedHat Linux. The point is that there is a qualification on the Linux, it's not the Linux. The Linux is not controlled by a company.
People are going to expect that problems with software connected to the internet to be fixed and fixed fast
This is a bug that is almost 2 years old. Your argument doesn't work here.
Please PLEASE read the article before you post. You made yourself look rather immature and foolish.
Marc
Actually, Windows works differently than Linux. Then kernel is located in a special
file (c:\io.sys) on your hard disk.
>>>>>>
Not in any Windows version is the kernel io.sys. It provides some DOS functionality, but the Windows kernel resides in kernel32.dll and kernel32.exe.
All of the extra hardware functionality (USB,
multimoniter, etc.) that you mention is tacked into the OS through a series of
interesting things like normal and virtual device drivers.
>>>
All the buses are in the kernel. That's why decent USB support didn't appear until 98 and why NT4.0 never got Firewire support until MS patched it. TheyUSB drivers required a lot of hacking to get past the kernel, and the Firewire drivers were impossible to write without the cooperation fo the NT kernel. Multi monitor is also part of the kernel because that is under the control of the graphics system, which resides in the kernel.
It's sort of like a
microkernel, only these drivers are accessed through a GUI (Windows) running on
top of the DOS 7 part and the kernel.
>>>>
Wrong again. Contrary to popular belief, Win95 does not run top of DOS. Its mostly anti-microsoft propganda. True, Windows 95 has DOS embedded in it, but does not use it all that much when running Windows programs. If you run fully 32 bit programs, Win95 rarely goes switchs into real mode DOS. WinME will finally take DOS out altogether, although it will still suck. I mean even Win3.1 only used DOS for the file system! Second, no Windows is really a microkernel. They want to tell you that NT is a microkernel, but in reality, it has most drivers embeeded in the kernel, and one big Win32 system server. Hell, in Windows 2000, the hardware abstraction layer includes calls to DirectX! (Though there is nothing wrong with that. It might be acedemically incorrect, but if MS would just let the DirectX guys do NT, Linux would be in major trouble.) Win9x is even more monolithic. Everything from the graphics and some GUI functions to file systems run in the kernel.
Unlike with a microkernel, the kernel never
actually touches the device drivers and things that Windows runs. Windows even
has it's own virtual kernel that runs on top of the actual one!
>>>
You're confused. The Windows kernel has complete access to hardware drivers. It doesn't run on top of DOS, it uses some DOS code in the kernel. Its just like the Linux kernel in terms of closeness to harware, but while Linux is completely 32 bit protected mode, Win9x has some sections that are real mode. Also, there is no virtual kernel. I think what confused you is that Win9x has a virtual machine that runs all Win16 programs, and many virtual machines to run DOS programs. All 32 bit programs run without a virtual machine.
Some of the other things you mention (icons, IE) are actually in executable code in
the GUI part of Windows and elsewhere, not through any interaction with anything
resembling the kernel.
>>>>>>>>>>>>>>
True, icons are not in the kernel. Faux pas on my part. However, they are pretty close. All the routines to load icons and do graphics are in the kernel. Like I said, Win9x is SERIOUSLY monolithic.
X-Windows isn't part of the Linux kernel, and IE isn't part of
the Windows/DOS 7 one.
>>>>>>>>>>
Stop sayiing Windows/DOS 7. There is no DOS 7 kernel in Windows, the virtual machine that runs on top of the Win9x kernel reports itself as DOS 7. Win32 programs never actually use that virtual machine. The DOS heritage that Win9x has is not that it runs on top of it, but that it uses a good deal of DOS code.
DirectX is weird. It is made up mostly of a large number of device drivers and
some executable code, although there are more complicated things in there.
>>>>>>
DirectX is god. DirectX is mostly device drivers, that's true, that's what gives it the speed. Conceptually, DirectX is a set of COM objects that talk to the DirectX HAL/HEL. The hardware drivers make up the HAL (hardware abstraction layer) and emulators make up the HEL (hardware emulation layer) the other executable code is the stuff that orchastrates to whole thing.
These security fixes mostly update DLLs and stuff NEVER the kernel. Again, most
of Windows is actually executables and libraries. The kernel is quite small and
doesn't do a whole lot except interpret for these executables.
>>>>>
Whoa, that's kind of wrong. Windows networking is implemented in the kernel on Win9x, and in kernel mode servers on NT. True, they might not be in the same executable, but they are for all purposes part of the kernel. Again, I don't think you quite have the right idea about Windows. In all versions of Windows, the kernel is quite large. (Again, in NT the kernel32.dll is not that big, but a lot of stuff runs that is loading into the kernel.)
In short, the actual kernel has not changed much, other than moving it from two
files (msdos.sys used to have part of it) into just io.sys.
>>>>
I'm assuming you're talking about Win9x here. The kernel is not io.sys or msdos.sys on any version of Windows. They are DOS modules loaded by the Win32 kernel to facilliate some operations.
USB and other nice things
never directly interact with the kernel, but work through executable code (win.com
and associated dlls and other files) that runs on top of the kernel and accesses
hardware.
>>>>>
Wrong again. USB and stuff does work through the kernel. DLLs may provide support for the actual device, but USB is a bus and busses in Win9x are supported by the kernel.
Linux, on the other hand, integrates USB and such into the kernel, so it
does not constantly crash because of the complex and unstable patchwork doing
things DOS was never meant to do.
>>>>>
You're sentences make no sense. Integrating something into the kernel make it less stable, not more. (Ever wonder why NT used to be really really stable in 3.x before they moved graphics into the kernel?) DOS has nothing to do with it. There is no code in the USB services that use DOS.
You have a very well thought out response. The problem is that you are doing
exactly what MS wants: seeing Windows as one big happy family rather than the
confused mish mash it is. Dig a little deeper, and you'll discover why the model is
insecure and why it crashes constantly.
>>>>>
You seem to be quite confused on what Windows is. I got all of my information from a BYTE article cirica launch of Win95 that detailed the architecture of Win95 (then Chicago.) (BTW. BYTE was THE nerds magazine. I've never since seen a mainstream mag that went into the kind of technical detail BYTE did. Read the one from 1993 about the new OSs that were coming out then. They talked about message passing and hardware abstraction layers like you had known about them forever!) True, Win9x is a mishmash, but the fact that it runs on top of DOS is just not true. Win3.1 did, but in Win95, everything was moved into a set of modules (such as USER32.exe and USER32.dll and GDI32.exe and GDI32.dll) which comprised the kernel. Some of those modules contained DOS code (at launch, GDI32.exe was largely 16bit Win3.1 code,) but that does not mean that Win9x runs on top of DOS.
A deep unwavering belief is a sure sign you're missing something...
- io.sys (system doesn't do anything with msdos.sys)
- command.com
- autoexec.bat
- config.sys
- win.com
- Other Windows files
The Windows kernel, as I mentioned, is seperate from the DOS kernel. Until the system loads win.com, you are running DOS 7. You can find the text DOS 7 embedded in these binaries. Windows, the GUI that we know and hate, is made up of binaries, libraries, and whatnot that run on top of these binaries that label themselves internally (yes, they do print out "Windows") as DOS. DOS and Windows are integrated in the sense that they come in the same box, but Windows is actually running on top of DOS like any other program, albeit with a little more functionality than other programs.The Windows "kernel" is a virtual kernel. The actual kernel in the classic sense of the word is the DOS io.sys.
Multimonitor and the buses are not really built into the DOS kernel in any real sense. USB and Firewire are present to a very limited extent. Again, you confuse the virtual kernel loaded by Windows and the real kernel of the OS Windows runs on top of just like any other program.
I did not say it was a microkernel, I made a (correct) analogy. Look at the files your system loads when running in Windows: all hardware is addressed through drivers which are not part of the kernel, they hook into it and are called through by it (it is not that simple, but they are most definatly not integrated into the kernel).
Windows loads DOS, then the GUI which is the actual Windows. The GUI Windows loads a virtual kernel that runs on top of the DOS kernel that uses various other drivers and junk to do stuff. DOS is, in no technical way, integrated into Windows. That's like saying that since you got you copy of Emacs and the Linux kernel on the same CD, they are integrated. Emacs runs on top of the Linux kernel, and is actually a lot like Windows (it can even run its own programs. I like the Tetris game better than Minesweeper).
True, Windows doesn't use the DOS system for a whole lot, because it basically replaces it, but try using a Zip drive in DOS mode. Windows includes a driver that works with it (don't cheat and use a DOS driver, now. You don't need it, since they're integrated.) What, it won't work? That's because the Windows kernel and associated device drivers are programs that run on top of DOS and its kernel, which is still sitting around in memory, handeling the tasks that aren't replaced by hooks from drivers.
One last time: Windows runs on top of the included DOS system. It loads other files to do stuff. But DOS is there. It is not one big system, there are many parts, and the kernel is just the rarely updated centre. MS would rather patch in functionality from other files than mess with the thing that regulates it all, or else they really would be integrated and you wouldn't have one kernel on top of another one.
If you have any other questions, we can just move this over to email. It's more convenient.
it's green.
Repeat after me: always, always close tags.
it's green.
To be fair the NT security model can be quite efficient is much more expressive than the very simple used in Linux. Of course you should immidiately modify the default settings... (and disable the guest account for example, restrict HD access etc. )
This is what is really bad with NT security, the default settings are a joke; but the base concept is quite good.
Calm down everybody.
Two questions:
Does this hole affect your system directly or
are you just discussing for fun?
Do you know an OS without any holes and bugs?
The difference between Open Source and the rest
is - that the open-sources doesnt have
problems with reporting those bugs.
And as u could see - the bug fix is already
there and u dont have to wait for a service pack.
Enough.
regards, sul (MCP soon MCSE - u gotta know
the enemy to fight him - sun tzi - art of war:-)
-=the truth is out here=-
The system may bootstrap using the DOS kernel, but the Windows kernel is certainly not a virtual kernel running on top of DOS. That was the case in versions prior to 3.1. Read the book about PCs by Peter Norten. It is quite helpful and describes certain things about the Windows kernel. In particular, it says that in Windows95, the functions previously handled by DOS were moved into modules within Windows95. Whether or not these modules contain DOS code is irrelevant. They are within Windows 95. If what you say is true, that Windows runs as a virtual kernel over DOS, then most tasks that require access to hardware would have to go through DOS. However, Win32 rarely, if ever, have to go into DOS mode. They only times that happens is when you have a funky program or driver that runs in real mode. What your saying doesn't make sense from the way the Windows arch is done. The lowest level is the huge Window kernel. Sure it loads stuff, but those are modules, and drivers (being modules as well) can be considered part of the kernel. Additionally, Win32 programs run on a system-wide virtual Win32 machine. Win16 programs run in a single Win16 virtual machine, and DOS programs run in multiple DOS virtual machines that load DOS before running the program. The major 16 bit DOS legacy that Windows has is mainly the legacy from Win 3.1. Major parts of some of the Windows kernel modules, like user, are 16 bit, which leads to instability.
PS> Programs and modules loaded into the kernel count as part of the kernel.
A deep unwavering belief is a sure sign you're missing something...
I'm sure you meant "Isn't it nice that Linus released a fix for his operating system right after getting back from vacation, and let me use it?"
It's not your operating system. It's Linus's operating system. He just lets you use it. If you purchased an operating system from a commercial vendor, then your gripe is with that vendor - they are responsible for all bugs and security holes they ship, not the authors. The authors just provide software out of generosity, without warranty, express or implied.
That people think anything else is the bad sign.
===== Send mail are hardly helping matters, though, by washing all the dirty linen in public, compromising the security of the whole product as they do so ===== The issue was originally posted to bugtraq on June 7th around 6pm and it had already been maliciously exploited even by that time. Sendmail's notice didn't come until the next morning. --- Not only that, but sendmail was specifically mentioned in the bugtraq posting...
I just wanted to make a note of something. In 2.2.14 and below, and 2.3 and above, the support for the RealTek 8139 card was listed in the config. But for some reason, its not listed in 2.2.15 nor .16.. Whats up with that? I'm not all about compiling that driver manually.
- Hi I'm Linus Torvalds and I pronounce Linux, Lih-nix..
Well, let see here. Supposedly this affects all kernels 2.2.15 and lower. Oddly Im 2.2.14, and I can't seem to reproduce this. I tried some of the source posted here, I tried some of my own code, and I tried some other stuff Ive found related to this. None of it seems to do what everyone says.
I thought this problem was part of the default kernel? Perhaps I didn't choose to compile a piece of the kernel that effected this?
While Windows is running, it looks like this:
DOS (idle, superseeded by the running programs most of the time) -> Windows (a program that has code to talk to hardware and bypass DOS) -> Windows applications.
Again, if you read what I have written, the virtual kernel is quoted, as I was using it as an analogy. I am trying to think of words to describe these concepts, and often come short. The fact I am trying to get accross is that Windows runs on top of DOS. It no longer uses DOS for much, because it has code to handle those functions. But DOS is there.
If what you say is true, that Windows runs as a virtual kernel over DOS, then most tasks that require access to hardware would have to go through DOS.
This is not what I said; it is the opposite. Look at my Zip drive example: my argument was that the Zip drive is controled entirely by the Windows program running on top of DOS rather than by DOS and that they are seperate from an engineering perspective for that reason.
The only point I was trying to make is that Windows and DOS are not the same although they are sold together, that the Windows kernel has not been updated recently even though drivers for it have, and that Linux is better because it's model is consistant and stable while the Windows model is fragmentary because things are never replaced but just hooked into by other things to make them work. I never said Windows relied on DOS, my point was that it tried to avoid that and replace the DOS it runs on top of.
it's green.
Does anyone have the change log for this summed up yet. I know taht normally I check at http://www.linux.org.uk and Alan Cox has his summary of changes, but that is not up yet.
Well any hoo I just downloaded it, boy do I love fast connections.
On another note I am not sure why people want to do so many OS comparisons. Here is my take on all the OSes that I have used.
This is just my opinion take it or leave it.
send flames > /dev/null
Only 'flamers' flame!
I specifically said "user" to imply someone of non God status and I even italicised the word.
Outlook comes set up by default to open each mail you get for you (previews), and can run scripts in this fashion without you even being in front of the computer, or you can disable this in Outlook which would limit these dangers to only occur as you click on them to read them, which of course is great security (cough).
This, is not, a good mail product. It is an extreme danger to the network performance and the integrity of user files and privacy.
Just receiving an infected email is enough with Outlook. Compare this to a Unix sys admin, is he likely to run a script he received through email, whilst being logged in as root? If so, he should not be an admin.
If I was the head of a company, #1. in the company policy would be that under no circumstances should a Microsoft product be allowed inside our local network. In fact, nothing that is not first run by Systems.
Microsoft, sucks.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
haha you'd be surprised. A lot of those kids are a lot smarter than most adults when it comes to kernel source hacking. They know what they're doing.
- Hi I'm Linus Torvalds and I pronounce Linux, Lih-nix..
There has been some FUD going around about how you can not sue Linux.
It is true.... and FUD...
Basicly.. you can not sue Linux or anyone who develups Linux for a defect in Linux due to the GPL. The GPL contains a shrinkwrap liccens that says you can not sue for defects in Linux.
Now here is the FUD part...
You can not sue Microsoft eather... Same reason...
Most (if not all) develupers have a shrinkwrap liccens that says you may not sue for software defects.
Not Sendmail not RedHat, Not Microsoft and not Sun Microsystems.
If a bug happends it's totally your problem.... no matter what your using...
In short... Real world... the lawyers have allready resolved this problem...
I don't actually exist.
I've been noticing people complaining about stuff like this. A lot. And I think I know the reason why it's always happening.
The people reviewing and approving stories don't review the links. They just post the story. Verbatim.
This is actually a good thing because if they started editting user submitted articles (the stuff in italics, all of it, in any way), they would be breaking their integrity, and a whole other segment of the /. community would be in an uproar. But, they are still responsible for these links. So what should they do?
How about updates and addendums. There used to be witty comments after each user submitted article. They could say things like CT: Use the mirrors from this list to download the kernel and leave the poor main server alone. Taking a little time to make sure the mirrors are respected shouldn't hurt too much.
Is this post not nifty? Sluggy Freelance. Worshi
I work at a company and i am in charge of 4 linux boxes (gateways and webservers)
and the only mailing list i need to check is the SuSE Security Announcements list,
if the bug is relevant to one of my systems download an RPM install it on the boxes i am done and done.
takes me about 10 mins to upgrade 4 boxes and i dont even leave my desktop. I takes me longer to download SP6.
So you i can safely say unless your support team are a bunch of cleuless monkeys you dont Need a massive support team.
42
Who said that anything posted to Slashdot was going to be objective, ever?
:-)
Just be sure to wear the gold uniform when you beam down -- you know what happens when you wear the red one.
Outlook comes set up by default to open each mail you get for you (previews), and can run scripts in this fashion without you even being in front of the computer, or you can disable this in Outlook which would limit these dangers to only occur as you click on them to read them, which of course is great security (cough).
Melissa nor any other VBS/Macro based worm is spread in the manner you describe. It is spread via attachments as I previously stated. In fact, I don't have experience with any virus, trojen, worm or other type of 'pathogen' of any kind that is spread by viewing them in Outlook's preview pane.
Would you kindly post examples, or are you done being a Micro-bigot? It's fine if you don't like their OS or their software, but at least don't spread disinformation about it. There's plenty of tangable problems you can hit on without spewing vapor.
References for you:
Info on the Melissa virus
Info on the ILOVEYOU virus
Is this enough or should I cross reference?
Comment removed based on user account deletion
Yeah, gotta moderate it down if it's dogging linux. Seriosly, when will the linux zealots grow up and realize that linux isn't the all-singing all-dancing OS to solve every problem on the planet they currently think it is?
Uhmm, I believe I am the first one to ask this. I believe that it's an interesting question, too. Strange (then again, it's Slashdot).
Could someone explain to me what this "new security model" is all about -- in very simple words?
I mean, please answer questions like:
- what about chmod and rwsrwxr-x and so on? Is that going to be a thing of the past?
- I thought that until now, we have always claimed that the "old" UNIX security model (chmod and stuff) was the best thing there was? What's wrong with it?
- Isn't the new model confusingly complex? Like, that users would not understand it and misuse it?
- Is this a sign that Linux goes it's own way and abandons UNIX?
...altogether, what's wrong with the "good ol' UNIX security model"?
It's... It's...
"We can confirm that Debian does *not* ship the version with the trojan horse. Our version predates it." [CA-2002-28]
Oh sorry Thalaric, I'm not quite done being a "Micro-bigot".
Here is that example you were after...
"It uses a vulnerability discovered by Georgi Guninski in which many versions of Internet Explorer 5 allow any HTML file or e-mail to write files without ActiveX authorization."
"Historically we've always said, as long as you don't open attachments, you're safe," Network Associates spokesman Sal Viveros said. "That's not true anymore."
BubbleBoy is a "proof of concept" virus that has no dangerous payload, meaning it doesn't attempt to delete or alter files.
http://www.zdnet.com/ zdnn/stories/news/0,4586,2392757,00.html
So, it can write ANY file without authorisation when it is opened or previewed. This is why I switched off auto preview at work.
Funny how you state your ignorance of such a beast and yet are oh so cocky to rub my bigot nose in what I have written about of which I am not ignorant.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
I found this article interesting as a novelty, but since the virus you're refering to (according to this link) is out of date by 7 months the only thing this proves is that I don't have my degree in history :)
Also, another distinction I should point out is that this virus only affected Outlook Express, not Outlook which was the topic of conversation, and didn't work on NT or have a payload. This isolated incident does not support your image of an OS "totaly lacking any security" as the security hole was patched 7 months ago as can be seen here.
I see your point though, security on the net is a big issue and always will be. However, it's an issue for Microsoft OS' AND *nix. For every security feature implemented a couple more develop.
Ill second that ... one week to go for 2.7 :)
Hi Thalaric,
The URL I quoted actually stated "Microsoft Outlook", but I did assume they meant Express. However Outlook also has the preview function, opf course without ActiveX it would be useless. So I might be guilty of assumption and limited research for reading that one URL and beleiving my memory of the incident.
However, that virus could have had a pay load. It can write to any file with the help of ActiveX, so why not NTLDR, COMMAND.COM, etc.
It was a proof of concept virus that worked. Showing that it could pose a real threat.
I know MS does not totally lack security, they do make attempts at it. And I know the *nixes are not perfect. But MS is by far the worst, and the money hunger that drives them makes them easy targets along with their buggy and insecure products.
How can they advertise how great their stuff is when bugs and exploits are always cropping up, especially with OS like OpenBSD on the market that have far fewer problems and are far cheaper and faster in many cases.
I tell you what though, even though I use Netscape and Outlook, I will still keep auto preview switched off.
Cya later.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
(This comment looks best in a browser that supports a lot of Unicode.)
This letter "very much like f", , is called long s. It had the advantage of looking good on paper, enabling more ligatures (st, sh, etc), and generally fitting the way type was designed. The italic print version looked like (an integral sign). Something similar was used in the old Gaelic and German alphabets (surviving today in the German letter ß, which is long-s + s and no relation to the Greek lowercase (beta)).
Will I retire or break 10K?
What's the proverb? "NO SECURITY WITHOUT OBSCURITY!". I thought that was what the "Open Source Security Model" was all about?
I believe the industry truism that you're looking for is "security through obscurity is not security at all", and means the exact opposite of what you've taken it to mean.
Hint; OPEN Source. How do you get Open Source as being about security through obscurity? How could one hope to obscure anything for long with the source open?
Answer; they can't. Open Source security relies upon the principle that not all the skilled coders who are looking at the code are nasty criminals looking to hurt somebody. Some of them are professionals like the Sendmail crew, who are interested in making systems more secure by eliminating the bugs.
Unless you want to rewrite everything yourself, you get bugs fixed by publicizing them so that others will be compelled to fix them. Since one man can only put in one man-hour per hour, that's necessary.
As for whomever told you "NO SECURITY WITHOUT OBSCURITY!", you should stop using them as a resource immediately, because they're 30 years behind the state of the art in OS security.
--
If you format the hard drive of the local machine, that's not much harder in Linux or any other OS. Just put in a diskette and reboot.
This is the precise reason that I switched to FreeBSD 5 years ago. CVSup for the whole system rocks! Linux was never very good at being coordinated enough to get out of my way.
I'm not saying Linux is bad, just that it wasn't for me!
That isn't fair to say. There are numerous other fine Operating Systems that people can use. The commercial Unixes are all viable. So is Netware. The new MacOS is coming on strong.
It's a mistake to focus only on Windows (which is a viable option, mind you), because you just makes it seem like Linux is the ONLY other option.
Hell, if you want a freenix, any of the three BSD variants are more viable than Linux. Unless you're a college kid in a dorm who wants all the 'latest' (as in- anything more than a year old, of course) wingie-dingie stuff.
Linux is a fine robust Operating System. When compared to Minix, which is really only the 'Ensigns training ship' Operating System, and that's all it tries to be.
Maybe I'm missing something here, but it seems to me that Sendmail's "workaround" isn't very useful.
If you aren't able to upgrade to the 2.2.16 kernel right away, they suggest that you download sendmail 8.10.2. This version of sendmail will check for the bug, and if it detects it, will stop
running. What use is that? The only machines that should be running sendmail in the first place are mail servers....and if sendmail bombs unless you've upgraded the kernel, installing it BEFORE upgrading the kernel would only result in a broken mail server.
It's not the severity of this particular problem that is an issue. It's how it makes those people who always tell us "Linux can't have a virus problem, because you can only infect your own files. Blah blah blah." Look if there is a standard problem in all kernels from 2.1.15 down then a Linux virus would be trivial and fully successful. Almost too bad that nobody exploited this problem before (that we know of anyway.) I hate it when partially informed people rant on about how this and that can't happen or how this and that are secure. Right.
If you want real stability and lack of problems, go for the last generation of kernel. For production boxes, 2.0.X boxes are probably a good idea.
For stability, yeah, 2.0.x is good (I've seen year uptimes on multiple 2.0.36 machines). Though of course the hardware support isn't as good, which can be an issue in some cases (ie if your SCSI card/video card/what have you doesn't work in 2.0, you might be in trouble).
Also, there are a lot of nice features in 2.2.x which you may want around, besides the hardware support (NTFS read support, SYN cookies (OK, maybe those were in later 2.0, I can't remember), and a much improved TCP stack, for some quick examples). Probably some security fixes too, though I think generally such fixes are backported to the older kernels if necessary - though that may change when 2.4 comes out, at that point 2.2 is the 'old' kernel, and 2.0 just becomes ancient. I dunno, I never saw too many fixes given for 1.2.x in recent memory.
if this is a bug that is 2 years old (and i haven't seen anything saying it is or isn't), the fact that it wasn't fixed until now isn't saying much.
If the bug had been known about for 2 years, that would be a different beast all together...
dennis
The warnings are harmless. Update your binutils to get rid of them.
-- v --
really? how so? just curious...
I suppose I'm not too threatening, presently, but wait till I start Nautilus
Actually, to successfully exploit this, you would need to have both 1)an SUID program with a known bug which was exploitable under the conditions of this kernel bug and 2) a kernel obefore rev 2.2.16. This bug does not seem to be exploitable _by itself_.
It says exactly what the security problem is. So what's the issue? Are you complaining that the grammar isn't perfect? If so, then you're totally off base -- grammar has never been Slashdot's forte.
Get over it.
--Joe--
Program Intellivision!
Incidentally, all the others have the gall to charge you $100+ for something they won't stand behind.
Truth about Linux? WTF planet are you from? A new patch was released right after this was found. Much, much better then M$FT's solution - "Yeah, we know about that bug -- we plan on fixing it later sometime". Or "Yeah, we know about that -- it's a feature!" The turnover on this bugfix is what a day? Christ, if you expect people to be perfect all the time then why aren't you out making Operating Systems that work?
I score such a superfluous comment as -10 - Stupid.
Streetlawyers been alternating between trolling and making interesting comments for too long. He knows how to karma whore like the best of them.
This is incase anyone reading at mod -1 accually takes you sereously instead of seeing you for the outragous lier that you are.
Hello legal type person allow me to give you my own history....
Age 15 started busness ran same until age 23. Sence then I ran for office (and lost)...
In short I have a lot of experence in BS.
Everyone lives within a community...
It's just a part of being a part of socity.
Linux Weekly News - "For a lot of people who watch the Linux business community Bluepoint came, well, out of the blue. What is this company, and how did it manage to go public so quietly?"
First note... even Bluepoint is part of a community. They are a new company. Moreover they are not a US firm but in fact in China. The objective of the company seems to be to introduce it's version of Linux to Chiniese busnesses. Thats just my point of view. This company could also be just annother "Linux One".
Bluepoint isn't the first company to have the name Linux. For example VA Linux Systems. Who own Andover.. who own Slashdot... And do not own Linux.
At least your living up to the lawyer stereotype. Thats kinda sad too becouse most lawyers are honnest people. You however seem to sling the BS better than any politician....
Being a part of a community is no more illegal than breathing air.
Your not stupid... your simply full of it.
In fact I am not telling you ANYTHING you don't allready know...
Excluding the fact that I also know...
I don't actually exist.
The guys responsible for this are the guys at Linux One (code LINX) - a very well known distribution operating out of Nevada.
Be careful not to sue them though, they have some very high-powered lawyers (much more articulate than you) and would take *very* *unkindly* to someone damaging their IPO chances. So would the SEC.
So keep yoah beautiful head down and don't bite off more than you can chew.
Mielipiteet omiani - Opinions personal, facts suspect.
I verified the exploit and upgraded all my end-user shell boxes before 2am.
Sendmail did the right thing. Details of the vulnerability were already publicly available, but had been misreported as Sendmail bugs.
The impact is that any local user (local shell access is required) can become root using techniques simular to those effective against pre-v8 versions of Sendmail. I've found two other vulnerable applications, surely there are more. If you can't figure it out given the information provided, good. Just upgrade your kernel.
There is no remote exploit.
BluePoint Linux can be found:
m
http://www.bluepoint.com.cn/english/info/index.ht
And from their web site are:
BluePoint Linux Software Co., Ltd. (BluePoint) is the leading Chinese Linux operating system provider in China.
(Just incase you're interested)
Cheers
"I'll take the red pill. No! Blue! AAAaaaahhhhhhhhh"
- Monty Python meets the Matrix
I would not throw to much praise to FreeBSD. Having the whole system on CVSup is cool, but I notice that someone broken "make world" in release not to long ago. Although, it was only broken for a couple of hours, there are advantages to not have your system rely on single place.
/usr/ports is pretty damn cool. I wish Slackware would get something this.
Linux O Muerte!
Why does person out there post and goes "Ha ha linux sucks" or some other flame bait? Why doens't anyone say "Whoa.. i got the security advisory and a patch is already ready". Personally I am only piss off at sendmail for sending off this big letter for no reason. Instead of using the normal channels for telling people they have to make a big noise and place thousands of servers at risk. For God's sakes.. people do sleep around here you know. We don't stay up all night hoping some new security problems need patching.
Well, if I wasn't posting to this thread, I'd definitely score you down as a troll.
Linux has one hell of a lot of users. Granted, OpenBSD has nowhere near as many. But hey, Windows has even more users. Does that make it that much better? And usage of *all* of these operating systems is growing. Don't believe what the magazines and polls tell you. The fact of the matter is that when you've got an OS up for ftp, there is *no* *way* to tell how many users it has. Period.
In fact, the rest of the world is moving towards BSD in a big way. Big starting with yahoo and hotmail, probably two of the largest sites on the web.
Basically, just put your prejudices down and give it a try. It works, and pretty well. Remember, a Linux monopoly would be just as bad as the current Microsoft monopoly.
-Dom
I think the AC is saying he dosn't believe your a lawyer or a graduate from Harverd.
And I strongly agree with his position...
You are to good a lier to be a lawyer...
That and you curse a lot... not a very.. umm profesional addatude...
I've seen some pathetic legal experts but you sir take the cake...
I don't actually exist.
This is not any worse than many of the security holes found on other operating systems over the past several years. It is necessary, for an actually secure environment, to keep up with newsgroups for any operating system. In many ways, Linux' open source nature makes these types of bugs easier to find, and more likely to be fixed than covered up. Patch up you OS people....
It sounds like yet another reason for businesses to not widely deploy Linux, unless they can afford to keep a massive support team busy following each and every mailing list and newsgroup.
But rather strangely it is ok to employ staff who's role is to reboot machines. As well as relying on (long and expensive) telephone calls to be told "reinstall it and hope it works".
Do businesses want to run code children are climbing around in breaking?
Shouldn't they be consideably more worried about running code from a criminal organisation? Any government or computer company is surely suicidal if they use Microsoft.
With something open source a business knows exactly what they are getting. If they are going to gamble with closed source products then at least avoid the proven "sharks".
I'm getting tired of running patches on top of patches (like the ide/udma patches)
is there a public CVS server that has the kernel so i can do a cvs update (and thus also auto merge)?
Send mail are hardly helping matters, though, by washing all the dirty linen in public, compromising the security of the whole product as they do so. What's the proverb? "NO SECURITY WITHOUT OBSCURITY!". I thought that was what the "Open Source Security Model" was all about? Myabe when the BSD thing is ready for release, they'll sort this problem out.
-- the most controversial site on the Web
This bothers me. How long was it known that there was this flaw in the kernel? Why didn't we hear about it before? Why wasn't there a simple patch to 2.2.15 that eliminated the flaw (as opposed to the few extra features we got in 2.2.16)? I guess it's possible that it's not a very easy to exploit bug, since Alan Cox, in the announcement, said he didn't recommend updating unless you had untrusted users.
You forgot to mention the part about them putting the fix in a "service pack" along with brand new bugs. You can't pick and choose from MS's service packs, you have to take the whole thing.
Not just brand new "bugs" but also whatever "features" MS happen to think might be appropriate.
Regardless of if they might be "junk" in other people's opinion let alone that they might be completly inappropriate for a specific corporate environment.
This newbie is forced to learn how to update his kernel.
Linux can be so interesting :-)
The nice thing about Windows is: it does not just crash; it displays a nice little dialog box and let's you press 'OK'
We all like the latest software. The problem is, the mainstream (read: Microsoft) OS's have a tendency to update slowly. (MS has set a few actual records for longest wait between releases of an actively developed product). I was looking at the dates on the kernels, and it hit me: 2.2.16 was released a few hours short of a month and four days after 2.2.15. When has MS managed that?
Come to think of it, what kind of changes were made in the kernel between Win95 and 98 (the kernel for these calls itself DOS 7 and 7.10 internally).
Not much. As far as I can tell (and I have done some research) the most major change was a recompile with different internel version numbers.
We all know free software is released faster. But even at the current reduced speed, this still amazes me. Just something to think about.
it's green.
Can we have a copy of your score sheet on the inchfan please? That way we can all know how to live up to your 31337 trolling criteria, and you can post those Score 10 out of 10 trolls you've done. Thanks.
---
Jon E. Erikson
Jon Erikson, IT guru
"Yeah, we know about that bug -- we plan on fixing it later sometime".
You forgot to mention the part about them putting the fix in a "service pack" along with brand new bugs. You can't pick and choose from MS's service packs, you have to take the whole thing. What's MS's record been with NT service packs? About 50 percent?
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Actually, f was not used for s. A letter very like f was used for "nonfinal" lowercase s, but it was a seperate letter. In print, it looked like an f without the crossbar; in cursive, like an f with the bottom loop done backwards. It was used for lowercase s when it was not the last letter in a word, much like the greek sigma.
If you have a facsimile of the Declaration of Independence, you can see numerous examples in T. Jefferson's interesting handwriting.
-JD
If Microsoft released a patch to WinNT saying, "there has been a security flaw in it from NT 4 SP 5 and all previous releases," the slashdot crowd would be all over it claiming that MS is a crappy company, and if Windows was open sourced this would never happen. However, if Linux does it, it comes from the "making things better" department....
>Wow you need to calm down. Blind zealotry doesn't fix bugs. Instead of
>saying good one less bug to worry about, you go and flame everyone in
>existence. That doesn't help.
Wrong. The moment you get people saying it's too much trouble to actually do the job they are supposed to be getting paid for, and start making excuses why they shouldn't be expected to *DO THEIR FUCKING JOB* It's time to start flaming the hell out of these people. Would *YOU* want someone like this working on the brakes of *YOUR* car for instance?
Very true, but then again I don't deal with NT - so I don't know much about the security model in place (snort) during a bugfix. All I do know is that a few short months ago I logged into an NT system of mine and figured that it was not worth anything (logged in as guest) started up the ole' M$dog debug program and told the system to low level the harddrive. It did.
Now that is (as Cartman would say) securitah.
never mind the rest of the world for who it's daytime.
stop being pissed off about people living in different timezones.
No one can understand the truth until he drinks of coffee's frothy goodness.
--Sheikh Abd-Al-Kadir, 1587
> We understand you are upset given the recent ruling, by resorting to postin flamebait on /. is now way to behave...
/..
We seem to have a particular problem with MCDAs (Micorsoft Certified Defense Attorneys), since they suffered a mass firing yesterday, and don't have anything better to do right now than troll on
--
Sheesh, evil *and* a jerk. -- Jade
I get the vague feeling that was a troll, but it at least makes me feel better to be writing this. :) And ditto...
I KNOW it's a troll...
Do a Google search on Bluepoint... They make a chinese Linux destro.
He is basicly lying... It didn't take much to find the stock ticker BTW...
I don't actually exist.
Well written comment. I only have a couple of objections to some of your statements.
> Q: Does this make linux more secure than closed source systems?
> A: No!
What it does do is give Linux the *potential* to be more secure (note the emphasis). Patches are released early and often, usually within hours of the security hole being found.
> Q: Is linux more secure or less secure than other systems?
> A: There is no clear answer. Weigh up the pros/cons of the security records of each OS you are considering, and the areas in
> which they have had security problems and decide for yourself.
A system's security can only be judged by comparing it with other systems. No system can be absolutely secure.
So, let's compare it with Microsoft's security model (I know, easy target...). The hole with VBScript in Outlook has been well known for over a year (Melissa was the first widespread exploit). Yet it took until *last month* for MS to *announce* that they intended to release a patch for Outlook. They still have not actually released that patch.
This does lead me to believe that Linux has a far greater potential than NT for having greater security.
In post-9/11 America, the CIA interrogates YOU!
>It sounds like yet another reason for businesses to not widely deploy
>Linux, unless they can afford to keep a massive support team busy
>following each and every mailing list and newsgroup.
>Let's face it, the 15 year olds live for this. Do businesses want to
>run code children are climbing around in breaking?
>(score:-7 Truth about Linux)
Crap. If you don't do things like this, what happends is exactly what we saw with ILOVYOU. How long did you Microsoft assholes sit on your asses knowing the truth about the various Outlook/VBS problems and pretty much did (and haven't really) nothing about it untill a hell of lot of people got burned by you shitty software design? The world is changing loser. People are going to expect that problems with software connected to the internet to be fixed and fixed fast. They aren't going to be interested in hearing excuses from people like you anymore.
Okay, you really don't know how this is done, do you? "Linux" isn't an organization that has a bunch of IPO money and is responsible for the operating system called Linux. "Linux" is not a company (hence no stock ticker). "Linux" is just a kernel that a whole bunch of people have helped to create, inluding the people over at Sendmail. Suing "Linux" would be very, very difficult, since it's very difficult who/what to actually name in the suit. What is more likely the outcome you're looking for is a bit more complicated and actually involves a company. When a new kernel is released, noone's required to download it and use it. I should hope that most companies *don't*, simply because of the possibility of problems, they're better off sticking to a tried-and-true kernel version. What companies *should* do to upgrade is to upgrade their Linux distribution (RedHat, SuSE, etc...). Distributions (should) test the versions of software that they ship out. They use the tried-and-true versions of the kernel and other software. They're suable.
So, in summary, "Linux" is not suable, "Linux" isn't even an organization. When the OS known as Linux is used by a distribution, they open themselves to possible law suits, and that's why they don't use the bleeding edge kernels.
When will the code-heads join the real world, huh?
The ones that do open source generally don't want to. The open source world is a great excape to the corprate/law/marketing world. So those distribution companies sort of form a buffer layer between us and the real world. They do the marketing; they have the lawyers.
The thing that makes the security folk I know bang their heads against their cheap metal furniture is vendors with security problems who either refuse to acknowledge them or wait "until the next full release" to patch them. They can almost sympathize with soom poor community-college admin trying to keep an NT shop running so he doesn't have the time, awareness, or maybe even the ability to fix his security holes - but the folks who ship broken stuff, that earns ire.
Thanks for the news, Sendmail. And thanks for pathing it so soon, Linux Community. Now - don't let it happen again! :-)
I love vegetarians - some of my favorite foods are vegetarians.
Oh yeah, like Solaris never has patches/maintenance updates, and Windows *certainly* doesn't have hotfixes/service packs.
Face it, every OS has problems, programmers are only human. As far as linux goes, I trust it more than Windows, haven't decided vs. Solaris, and probably a bit less than OpenBSD.
XML is like violence. If it doesn't solve the problem, use more.
This is not a problem if you restrict physical access to a machine. You can also have the box only boot to the HDD and install something like PC Bodyguard to protect the BIOS.
Comment removed based on user account deletion
This is what is really bad with NT security, the default settings are a joke; but the base concept is quite good.
Agreed. The security model of NT is basically a superset of *nix and VMS'. Not very surprising, since Dave Cutler also designed VMS, and one of the targets for WNT was to be posix compatible (a requirement by the US gov.).
The stinker is that NT comes rather unsecured out of the box, and it is a bitch to go over all ACLs by hand.
If J.K.R wrote Windows: Puteulanus fenestra mortalis!
Yeah aint it a stinker :)
I don't actually exist.
Neat. So, I had to kill one of my netscape windows. Doesn't prove a thing.
Linux rocks!!! www.dedserius.com
www.dedserius.com
VB != VisualBasic
Most modern bioses have password protection. Mind you, it may not be the most secure and access is often only a jumper pull away, but it's better than nothing (not that I use it).
Bill - aka taniwha
--
Leave others their otherness. -- Aratak
I wrote two little programs to test this; one to test whether giving up privileges works, the other to start a shell with the CAP_SETUID capability removed. To check the bug on your system do:
$ wget ftp://quatramaran.ens.fr/pub/orabidoo/tmp/blep.c. c
$ wget ftp://quatramaran.ens.fr/pub/orabidoo/tmp/suidcap
$ gcc -o blep blep.c ./blep ./suidcap ./blep
$ gcc -o suidcap suidcap.c
$ su
Password:
# chown root.root blep
# chmod 4755 blep
# exit
$
BEFORE: [your-uid] 0
GAVE UP: [your-uid] [your-uid]
GOT BACK: [your-uid] [your-uid]
(this is the expected result)
$
launching shell...
sh-2.03$
BEFORE: [your-uid] 0
GAVE UP: [your-uid] [your-uid]
GOT BACK: [your-uid] 0
PROBLEM!!
If you don't see the 'PROBLEM!!' part, then you don't have a problem.
First of all I would like to point out that the underlying cause of this is that Linux is moving towards having two security models. One is the traditional, "Root is GOD but can setuid" model and the other is "POSIX capabilities". This is a situation where an operation that should have worked under the old but which due to an oversight was insecure on the new. This may not be the last thinko of this sort. OTOH POSIX capabilities are an improvement on the old model so this is good in the long run.
Now why am I saying POSIX capabilities? Well here is a FAQ that goes into what is in the kernel. The traditional definition of capabilities are used by, for instance, EROS. This is incredibly secure. So when the POSIX standard was being developed for improving security by borrowing VMS' "privileges" they deliberately called them "capabilities" to introduce confusion and make people think they were better than they are. (Not that they are not an improvement on the old...)
Now the good sendmail folks have at this point every reason to believe that this particular thinko is likely not limited to Linux. Hence their check which they would hope will catch other current examples, and future ones if other people mess up. If they didn't do something like this then their (already pretty bad) reputation for security would get worse as they are an obvious target for taking advantage of setuid bugs.
Cheers,
Ben
My usual seat in the cluetrain is at A HREF="http://pub4.ezboard.com/biwethey.ht