Slashdot Mirror
Security Bug Doesn't Discriminate
An anonymous reader writes: "Despite all the fuss about Microsoft's booth at LinuxWorld next week, a security bug doesn't seem to care about the difference between open- and closed-source systems. The bug, found in a code library included in several popular applications, affects Windows 2000, Solaris, Mac OS X, and Linux, reports
eWeek's Dennis Fisher."
We can expect the fixes for all the open source systems to come way before Microsoft's "investigation" is complete.
(Anonymous, so as not to be a karma whore)
Researchers have identified a security flaw in a code library included in numerous popular applications that could enable an attacker to execute code on remote servers.
The problem affects the External Data Representation (XDR) libraries derived from Sun Microsystems Inc.'s SunRPC remote procedure call technology. XDR libraries are used to translate data between systems, regardless of their architecture.
"Despite all the fuss about Microsoft's booth at LinuxWorld next week...
Excuse me, but what the fuck does that have to do with anything??
What was the original liscence for Sun's XDR library ? (genuine question)
I believe this XDR vulnerabilty stems from a more serious problem in most implimentations of calloc()
The problem is created when the size of the ADT * numElements > a machine word
I'm parphrasing from this advisory on bugtraq
Security Update 2002-08-02
- This update addresses the following security vulnerabilities which affect current shipping versions of Mac OS X Server. These services are turned off by default in Mac OS X client, however if these services are enabled then the client becomes vulnerable. It is recommended that users of Mac OS X client also apply this update.
- OpenSSL: Fixes security vulnerabilities CAN-2002-0656, CAN-2002-0657, CAN-2002-0655, and CAN-2002-0659. Details are available via:
http://www.cert.org/advisories/CA-2002-23.html
- mod_ssl: Fixes CAN-2002-0653, an off-by-one buffer overflow in mod_ssl Apache module. Details are available via:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN
- 2002-0653
- Sun RPC: Fixes CAN-2002-039, a buffer overflow in the Sun RPC XDR decoder. Details are available via:
http://bvlive01.iss.net/issEn/delivery/xforce/ale
r tdetail.jsp?oid=20823
So unless you're a hardcore geek who turns on SSL, and hasn't yet updated to the latest security updates, you should be fine with your version of OS X (client). OS X Server users would probably have updated already.I am artificially intelligent.
The TCP stack, zlib, now this.
It makes me wonder just how much of other peoples code Microsoft utilizes, and then locks down with their "Thou Shalt Not Even THINK About Reading This Code" end user license agreement...
Bob-
The Ludwig von Mises Institute. The reasoning individuals economics
BUFFER OVERFLOW FOUND IN RPC!
"I assumed blithely that there were no elves out there in the darkness"
And it is totally within their rights.
The phrase, "lost in the translation," is made to fit the global marketplace. In today's multicultural IT workplace, water cooler conversations may take place simultaneously in several different languages. IT professionals and their software, however, need to speak a common tongue. The subject of this "true IT blooper" learned that lesson the hard way.
Every story in our bloopers series comes to us directly from a SearchWindowsManageability user. For obvious reasons, some contributors -- including this tale's author -- choose to remain anonymous. So, we'll call him Kim Chung.
When Chung was a rookie security engineer, he was asked to handle his company's annual security audit. Anxious to make a positive impression on co-workers in his new department, Chung offered to stay late and run a few seemingly simple and routine system checks.
One of Chung's chores was setting up a new security policy on 14 different Windows servers. As Chung set about changing this configuration, he was prompted by the system regarding its Remote Procedure Call service, "I didn't know much about RPC," He admits now. "All that I knew was there are tons of vulnerabilities concerning RPC services."
After careful consideration of how to handle these settings, Chung said he came to this conclusion: "RPC? You evil!" So, he stopped all RPC-related services until two the next morning.
As he continued to check additional RPC settings, Chung's system asked him to select a startup type. Well, he'd shut down RPC-related services. Also, he didn't have a high opinion of RPC. So, he chose 'never in use.'
Looking back, Chung realizes that he didn't know what the heck "never in use" meant. Before taking the job in question, he'd only used Windows in Korean, and never the English edition. Even so, he thought he understood the command in the English version and carried on. He'd stayed late to do this job, by golly. He wasn't going to let that evil RPC stop him!
Unaware that he had fouled up the configuration, Chung then restarted all of the systems. Around 2 a.m., he turned out the lights, locked the server room door for the night, and headed for home. "I was so sleepy!" he recalled.
Before reviewing the rest of the evidence against Chung, a few words in his defense. Numerous studies show that sleep loss impairs the ability to perform tasks involving logical reasoning. () So, it's logical that Chung left without making sure that the restarted systems were operating properly.
Sleep deprivation also affects memory. So, Chung didn't remember failing to check the systems. Indeed, he returned to work early the next morning with a spring in his step. His co-workers would thank him, he thought, for staying late so that they could go home. His boss would pat him on the back for getting up to speed on the predominately English network so quickly.
What awaited him was complete disaster.
"I had re-installed all the systems," Chung said. Selecting the 'never in use' option for the server's RPC services had caused the carefully constructed new configurations to be overwritten to their default settings upon his reboot.
Was he embarrassed? Red in the face? Perhaps a little concerned about keeping his job? "It seemed that the earth was rocking and thunder was roaring to me," he said. That could be construed as a deep concern for one's job, don't you think?
With the earth rocking beneath him and thunder roaring in his hears, our hero knocked on his administrator's door and turned the knob. Luckily, his boss chalked Chung's blooper up to lack of experience. So, Chung got off with little more than an `A' for effort and a stern warning: Watch your language!
-Brent
I don't know about "original", but I can go back as far as RPC 3.9. They didn't even have a copyright notice. The license was almost entirely a disclaimer.