Slashdot Mirror
Sun Security Patch Introduces Security Hole
Rich0 writes "Sun is announcing that their 'Security Hardening Package' for their Cobalt RaQ 4 Linux servers allows remote users to execute arbitrary code. Ironically, the solution is to remove the package, potentially removing protection from other compromises. There's a CERT advisory, as well as an article posted on Extremetech." Yikes, one would hope there's a forthcoming patch in the works.
Um you do realise these were Sun Linux servers don't you?
that particular machine runs a custom rolled distro of Red Hat 6.2 and has been known to be very reliable, and have mild issues from updates. every one of the holes it covers has some sort of workaround, which those admins have probably employed already.
i'd like to take this opportunity to complement the Cobalt Raq Users List members as well. without people like bruce timberlake, jeff lasman, steve werby (a /. contributor) and a whole host of others (can't name everyone) the raq has a vibrant community of admins willing to help even the newbiest of owners.
my machine runs on a lovely 64-bit mipsel processor from MIPS and is one of the dutch (sun bought cobalt a while back, it started on the other side of the pond) original models. they are tremendously power efficient, quiet and dependable boxen. mine uses a dinosauric 2.0 kernel and modified red hat 5.1 , and runs php 4.1.2/mysql like a champ.
not only that, but the cobalt raq IS a web appliance. In other words, its not really meant to do all that out of the box (back then anyway). today's raqs run a full gamut of oss and free software, and come pre-installed with everything you need as a webmaster.
it is an oustanding machine for NT admins to learn how to switch over, with the cushion of a working system to learn from.
yes, sun doesn't always get it right, but they put their backs into it so to speak, and it is not unusual for a Cobalt engineer to post solutions (even unofficial ones) to the list.
for all you cobalt users out there, you know what i'm saying, and if you're not on the list, you're missing out.
this post has voided your warranty. peace.
"You never want a serious crisis to go to waste." - Rahm Emanuel
Has *anyone* actually read the SUN announcement.
a Q4-en-Security-2.0.1-SHP_REM.pkg or later
I quote:
===
5. Resolution
This issue is addressed in the following releases:
Intel
* http://ftp.cobalt.sun.com/pub/packages/raq4/eng/R
===
Exploits for this vulnerability are already all over the internet, and the first boxes have been hacked. Just yesterday I read in a newsgroup that a Dutch ISP had a box cracked, probably because of this hole. So if you own a RaQ please take some extra care and look twice if you're safe.
I think people may have missed the point of this article, which is that Sun say that there is no workaround for the hole.
If it is true that the vulnerability is caused by a flaw in the input validation of a CGI (common gateway interface) script, and yet there is no workaround other than removing the Security Hardening Package, this implies that the CGI validation script (overflow.cgi) is not available for modification, so regardless of what license this is under, it's effectively not open source, otherwise there would be a workaround.
Well, we hardly need reminding of that in this forum, but perhaps somebody should make this point to ExtremeTech and to Sun. The CERT advisory rather oddly avoids this point as well, despite identifying the flawed component. It probably just shows that a company's inflexible procedures (package updates in this case) can effectively close even a theoretically open platform like the RaQ.
"The question of whether machines can think is no more interesting than [] whether submarines can swim" - Dijkstra
Oh, please read the damned advisories before claiming things that aren't true...
a Q4-en-Security-2.0.1-SHP_REM.pkg
:)
The official solution is not to remove the whole package, but to install this patch:
http://ftp.cobalt.sun.com/pub/packages/raq4/eng/R
Note that it's a flaw in the admin site scripts that causes this problem. So if you don't use that and have disabled it, then no problem.