Security Bug Doesn't Discriminate

An anonymous reader writes: "Despite all the fuss about Microsoft's booth at LinuxWorld next week, a security bug doesn't seem to care about the difference between open- and closed-source systems. The bug, found in a code library included in several popular applications, affects Windows 2000, Solaris, Mac OS X, and Linux, reports eWeek's Dennis Fisher."

Comments

Description of security flaw from the article.

[Anonymous Coward]

(Anonymous, so as not to be a karma whore)

Researchers have identified a security flaw in a code library included in numerous popular applications that could enable an attacker to execute code on remote servers.

The problem affects the External Data Representation (XDR) libraries derived from Sun Microsystems Inc.'s SunRPC remote procedure call technology. XDR libraries are used to translate data between systems, regardless of their architecture.

Re:There is a difference .....

[Van Halen]

According to the CERT advisory, the following (among others) have already released patches:

Apple (Mac OS X)

Debian (partial fix)

Glibc

MIT Kerberos

NetBSD

The following have not:

HP

IBM

Microsoft

RedHat

SGI

Sun

It may be interesting to see how quickly members of the second group catch up.

calloc() vuln

[m0rph3us0]

I believe this XDR vulnerabilty stems from a more serious problem in most implimentations of calloc()
The problem is created when the size of the ADT * numElements > a machine word
I'm parphrasing from this advisory on bugtraq

Mac OS X (client) isn't vulnerable by default

[nebbian]

From http://www.info.apple.com/usen/security/security_u pdates.html:

Security Update 2002-08-02

• This update addresses the following security vulnerabilities which affect current shipping versions of Mac OS X Server. These services are turned off by default in Mac OS X client, however if these services are enabled then the client becomes vulnerable. It is recommended that users of Mac OS X client also apply this update.
• OpenSSL: Fixes security vulnerabilities CAN-2002-0656, CAN-2002-0657, CAN-2002-0655, and CAN-2002-0659. Details are available via: http://www.cert.org/advisories/CA-2002-23.html
  
  
• mod_ssl: Fixes CAN-2002-0653, an off-by-one buffer overflow in mod_ssl Apache module. Details are available via: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN- 2002-0653
  
  
• Sun RPC: Fixes CAN-2002-039, a buffer overflow in the Sun RPC XDR decoder. Details are available via: http://bvlive01.iss.net/issEn/delivery/xforce/aler tdetail.jsp?oid=20823
  
  

So unless you're a hardcore geek who turns on SSL, and hasn't yet updated to the latest security updates, you should be fine with your version of OS X (client). OS X Server users would probably have updated already.

Re:Ah! Another "Derived" Work by Microsoft

[Dahan]

FYI, MS's TCP stack isn't BSD-derived. Where do they use zlib, btw?

Re:Ah! Another "Derived" Work by Microsoft

[Evro]

http://news.com.com/2100-1001-860328.html

at least nine of Microsoft's major applications--including Microsoft Office, Internet Explorer, DirectX, Messenger and Front Page--appear to incorporate borrowed code from the compression library and could be vulnerable to a similar attack.