Slashdot Mirror

← Back to Stories (view on slashdot.org)

Vulnerabilities in FreeBSD

Posted by timothy on from the finding-and-plugging dept.

flynn_nrg writes: "O'Reilly has an interesting article about vulnerabilities in common programs found on most FreeBSD boxes. From the article: "Welcome to Security Alerts, an overview of recent Unix and open source security advisories. In this column, we look at buffer overflows in OpenSSH, Squid, Listar/Ecartis, slrnpull, and IRIX's syslogd; problems in Sudo, MHonArc, and Mosix; and a local root hole and denial-of-service attack vulnerability in FreeBSD.""

3 of 63 comments (clear)

  1. FreeBSD vulnerabilities? by rsidd · · Score: 5, Insightful

    The article covered two vulnerabilities specific to FreeBSD, a few in third party programs which apply to all platforms (the article itself makes no reference to FreeBSD), and some vulnerabilities (mosix, IRIX syslogd) which are specific to other platforms (Linux and IRIX respectively) and have nothing whatever to do with FreeBSD
    So how does that make it an article on FreeBSD vulnerabilities?

  2. Lame Article by smnolde · · Score: 5, Insightful

    Gee, just two FreeBSD vulnerabilities in that article.... I run several FreeBSD workstations and servers and neither of them would be affected because it's easy to workaround those problems and equally simple to track -STABLE.

    Ever get into rpm hell on a redhat box? Debian might be a little better, but still, Debian is barely more than a kernel from being FreeBSD. FreeBSD is infinitely simpler to tailor to your needs and manage than any other *nix system I've tried.

    This article doesn't discourage me a bit, since fixes for the mentioned vulnerabilities were available so soon after the announcements. I absolutely love FreeBSD for all me needs and encourage other to install and learn it.

  3. Linux has becoming more and more unstable by Anonymous Coward · · Score: 1, Insightful

    I used to be a big Linux advocate, unfortunately it seems that Linux has been becoming more and more unstable. The hundreds of different distributions of Linux all have their pros and cons, but there is no centralised package or ports system. Want a package for Linux ? Ok, cool - DEB, RPM? RPM? That's the most popular. But don't try using a Mandrake RPM or a SuSE RPM on RedHat.
    Linux has given up its usefulness for graphical installers and Windowesque gimmicks. The code bloat is unbelievable. Unless you roll out your own distribution or use a minimalist distribution like Slackware, the default installs for RedHat, Mandrake, etc are huge, Windows-like monstrosities.

    So what?, I hear you say. Linux is stable and secure. Wrong again. The Lion worm proved that Linux is not as secure as one might believe. The fact that VMs get changed in the middle of a stable release branch (2.4.x) shows bad organization.

    It took Linux years to overcome its awful filesystem problems, and now journalling filesystems are available. But speedwise, compared to the FreeBSD FFS, they are slow and cumbersome, and have yet to prove as reliable. FFS Softlinks are a few generations ahead of any journalling filesystem on the market.

    FreeBSD is far better organized, the ports and packages collections are better synced and more reliable, the system is more stable and easier to understand. The firewall included with FreeBSD has been proven and has a far better track record than ipchains or iptables, the latter having security problems in its first week or release, the former having no stately inspection and being a complete mess due to its shell-script bound layout.

    But Linux has more software than FreeBSD!, scream the Linux die-hards. What they fail to realize is that 99% of Linux software runs under FreeBSD. I haven't encountered a Linux program that didn't run under FreeBSD. Sure, I've heard reports by trolls that certain software doesn't work, but all the software I've tried works, in fact, even faster than the native Linux versions in most cases. To the VMWare troll: Yes, VMWare does work under FreeBSD.

    FreeBSD vs Linux is a debate that won't ever be settled, but people who have used both generally prefer FreeBSD for mission-critical tasks. Those who claim that FreeBSD performs worse than Linux either haven't used FreeBSD or are trolls.

    I won't say that FreeBSD is the best Unix variant on the market, but the best open source Unix variant? Yes. Solaris is still tops, but in terms of Free (Open Source) systems, FreeBSD is probably the best all-rounder. NetBSD, OpenBSD and Linux all have their respective places, but overall, FreeBSD will probably take over most of the open source server market, at least in organizations with serious management.