Slashdot Mirror
Sun Security Patch Introduces Security Hole
Rich0 writes "Sun is announcing that their 'Security Hardening Package' for their Cobalt RaQ 4 Linux servers allows remote users to execute arbitrary code. Ironically, the solution is to remove the package, potentially removing protection from other compromises. There's a CERT advisory, as well as an article posted on Extremetech." Yikes, one would hope there's a forthcoming patch in the works.
Bugs happen every day.
Patches are generated in response to those bugs
Patches sometimes generate further bugs
Sometimes these bugs involve security. D'oh
profit?
MS: doesn't release bug fixes because their are no bugs. Only security updates and service packs to appease people.
Sun: releases a bug fix with an even bigger bug.
Linux: released bug fixes quickly.
And that's it, linux will forever be in last because of the fact they can't follow simple rules. You would think that everyone had a copy of Linux's source the way bugs are spotted and fixed so quick .. sheesh. Perhaps we should try and sell the source of linux to India?
PS - that was sarcasm ...
Ignore the "p2p is theft" trolls, they're just uninformed
"What on *earth* are you doing there?"
"I'm ripping the patch off this inner tube."
"You're taking the patch off? Whatever for?"
"Well, you see, it's got this big hole in it."
"Ummmmmmmmm, are you *sure* you know what you're doing?"
"Don't worry, I can patch the patch when I get home and then nail it back on."
KFG
that particular machine runs a custom rolled distro of Red Hat 6.2 and has been known to be very reliable, and have mild issues from updates. every one of the holes it covers has some sort of workaround, which those admins have probably employed already.
i'd like to take this opportunity to complement the Cobalt Raq Users List members as well. without people like bruce timberlake, jeff lasman, steve werby (a /. contributor) and a whole host of others (can't name everyone) the raq has a vibrant community of admins willing to help even the newbiest of owners.
my machine runs on a lovely 64-bit mipsel processor from MIPS and is one of the dutch (sun bought cobalt a while back, it started on the other side of the pond) original models. they are tremendously power efficient, quiet and dependable boxen. mine uses a dinosauric 2.0 kernel and modified red hat 5.1 , and runs php 4.1.2/mysql like a champ.
not only that, but the cobalt raq IS a web appliance. In other words, its not really meant to do all that out of the box (back then anyway). today's raqs run a full gamut of oss and free software, and come pre-installed with everything you need as a webmaster.
it is an oustanding machine for NT admins to learn how to switch over, with the cushion of a working system to learn from.
yes, sun doesn't always get it right, but they put their backs into it so to speak, and it is not unusual for a Cobalt engineer to post solutions (even unofficial ones) to the list.
for all you cobalt users out there, you know what i'm saying, and if you're not on the list, you're missing out.
this post has voided your warranty. peace.
"You never want a serious crisis to go to waste." - Rahm Emanuel
Has *anyone* actually read the SUN announcement.
a Q4-en-Security-2.0.1-SHP_REM.pkg or later
I quote:
===
5. Resolution
This issue is addressed in the following releases:
Intel
* http://ftp.cobalt.sun.com/pub/packages/raq4/eng/R
===
What Microsoft is saying is simply "some time ago we signed and released a piece of code. this code has bugs. don't download it. yes, it is signed but so what? don't download it anyway."
Say I have a 3-year old PGP distribution signed by PGP Corp. It is signed. But it has known bugs (discovered long after signing). Should I install it? No. The fact that it is signed does not mean anything beyond simple fact that it was produced by particular person/corporation.
By the way, do you know any other vendor who has been signing their software as long as MS?
I remember Apple updates simpy downloaded unsigned code from their web server, without verifying any signature at all. So a man-in-the-middle could inject trojan.
Linux ISO-files usually are "protected" by MD5 hash. So if you sit in the middle and can modify both ISO file and MD5 hash, you can do whatever you want with this distribution.
MSDOS: 20+ years without remote hole in the default install
Exploits for this vulnerability are already all over the internet, and the first boxes have been hacked. Just yesterday I read in a newsgroup that a Dutch ISP had a box cracked, probably because of this hole. So if you own a RaQ please take some extra care and look twice if you're safe.
Another issue is that sometimes to fix a bug, a newer version of a code block may be used (like taking a Linux 2.5.x solution back to fix a bug in 2.4.x). This code block may have unwanted functionality (because it has been inadequately tested).
Now all the above goes for commercial software, where there is a formal testing and 'fixit' budget. It therefore goes for free software too. Although individual teams are well motivated to sort out their software, it is more difficult to organise proper testing across teams.
In this case, we are lucky as a single team are working on this and it was sorted out quickly. Somehow some closed source developers don't seem to be so good about quick releases of their patches, and when they do, they still contain as many bugs (IE patches anyone?).
The problem with this Cobolt 'security' release is one of a flawed implementation. Microsoft's bug was one of tragically bad design. The latter is much harder to work around.
OS Software is like love: The best way to make it grow is to give it away.
I think people may have missed the point of this article, which is that Sun say that there is no workaround for the hole.
If it is true that the vulnerability is caused by a flaw in the input validation of a CGI (common gateway interface) script, and yet there is no workaround other than removing the Security Hardening Package, this implies that the CGI validation script (overflow.cgi) is not available for modification, so regardless of what license this is under, it's effectively not open source, otherwise there would be a workaround.
Well, we hardly need reminding of that in this forum, but perhaps somebody should make this point to ExtremeTech and to Sun. The CERT advisory rather oddly avoids this point as well, despite identifying the flawed component. It probably just shows that a company's inflexible procedures (package updates in this case) can effectively close even a theoretically open platform like the RaQ.
"The question of whether machines can think is no more interesting than [] whether submarines can swim" - Dijkstra
Bugs happen every day.
Are you insinuating we should just ignore bugs from now on? Especially one that "allows remote users to execute arbitrary code". Seems newsworthy to me, even if it's not a Microsoft bug.
Oh, please read the damned advisories before claiming things that aren't true...
a Q4-en-Security-2.0.1-SHP_REM.pkg
:)
The official solution is not to remove the whole package, but to install this patch:
http://ftp.cobalt.sun.com/pub/packages/raq4/eng/R
Note that it's a flaw in the admin site scripts that causes this problem. So if you don't use that and have disabled it, then no problem.
A maintainance release for Solaris 8 enabled additional features in BIND 8 which were known to be vulnerable at the time the maintainance release was shipped. Previous versions lacked the feature and thus the vulnerability.
Of course, this was much more dangerous than the current case because it had already been claim that Solaris 8 was not affected by that BIND bug.
This is pure FUD. You don't have to turn on "Always trust Microsoft Corp" to donwload any control. For every control you decide whether you want to download it or not. Signature only verifies that it is coming from Microsoft, nothing more. You should decide yourself whether you want particular control or not. Signature verify the origin, not content.
Just like in Sun's situation: some fixes are broken, some are not. You decide install or not. You should know what you are installing - security vulnerability or a fix.
Microsoft's bug was one of tragically bad design.
Where is bad design? I am sure that if Sun signs their patches, both bad patch and a fix are signed by same key. A key per file is just stupid and does not make any sense. You don't want to turn your PKI infrastructure into file-recall infrastructure. When PGP found a bug in their software, they did not recall the public key used to sign previous builds. They simply released a fix, and singed it (probably by same key, but I can't verify this).
OK, happy Microsoft bashing.
MSDOS: 20+ years without remote hole in the default install
Anyone who's been a Sun administrator has seen Sun screwup patch packages (breaking something during the fix). This is not news. What is going to happen is that in a week or two (or months, depending on the severity or difficulty to fix), Sun will release yet another patch package that will resolve the issue.
So if you put it in, back it out. Devise your own workarounds if you think its a significant vulnerability. Security is established through design and monitoring. Firewalls, subnets, switches, ssh, checksums, login authentication, log monitoring. You can't rely on vendors to resolve your security issues. Companies can only fix the security holes that they are aware of. You're only screwed when you're stuck with an improperly designed legacy system or policies that can't be defended. But that's not Sun's fault.
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon
Sun bugs do happen, but not that often. "Sun Security Patch Introduces Security Hole" is a pretty rare phenomenon, and even thou I don't use Sun gear, I do want to hear about it. Loud and Fast.
Have you ever actually managed a patching system for solaris? It's god aweful. At my last job I ended up writing a suite of scripts that managed all our patching and even then the patching was troublesome as numerous patches broke other things.
Sun currently has a bug in 108940-45 through -48 that they haven't fixed, and then they haven't made the last good version of the patch available.
As of two years ago sun had over 4GB of patches.
Half the problem is that everything is managed individually, so a lot of people don't actually patch until they have a direct need to do so, ie something doesn't work or they get attacked. It's too difficult to apply the latest patches and then make sure nothing was broken. I've been burned several times by sticking with the latest patches. It can easily take half of a full time employees time to keep a mmodestly sized network patched.
I'm not saying anyone is better off, but sometimes more is less.
-shane
"Not knowing when the dawn will come, I open every door." - Emily Dickinson
If a piece of software doesn't work right or introduces severe security issues, simply remove it until it is corrected.
It's a good thing that OS developers are smart and would never be so stupid as to develop an OS that would require a high security risk software, like a browser, just to run. An OS has to be modular and highly configurable in order to do that, and that always makes more sense than a monolithic beast.
I rarely read replies, it's my opinion and if you thought about your opinion a little more, I'm OK with that.
There are workarounds though including removing the offending package. This is NOT Solaris, it's just a Linux distribution on the Cobalt RaQ. In my honest opinion though I would no longer recommend a Cobalt RaQ to anyone anymore since Sun bought the company. They have gone downhill and patches take months to come out. We didn't get a patch for the Apache ROOT EXPLOIT for over 2 months! Thankfully there is a dedicated community that helps to support the product and there was a workaround using the mod_blowchunks, or you could recompile Apache yourself, but then why pay $4k for an appliance if you're compiling shit? I could just get a $500 x86 box and install Debian on it. Anyway, when it comes time to replace the raq4's I guess we'll just have to hack together scripts to do everything the RaQ did as far as GUI administration or maybe try one of those packages.
The "Security Hardening Package" makes security harder (to implement). For some reason, I'm suddenly reminded of Marvin Martian's "ACME Disintegrating Pistol".
Isn't that this whole thing got started in the first place? Instead of a security patch they should release a "zero security" patch. If they're consistent, using the powers of reverse psychology it will be the most secure system ever developed.
I so told you that Microsoft was a trend-setter.
You owe me a buck, man.
Keep your packets off my GNU/Girlfriend!
Precisely. There is no way for a user to say that "this version is bad. don't even offer to install it". MS can't use a different signature, and the MS EULA may even make it illegal for a user to disect to file to find out if it's realy trustable. MS's signature system was designed by marketing. It didn't take into account the possibility that their own code might have to be marked as bad.
Bad design.. Nothing a user can (legally) do about it
OS Software is like love: The best way to make it grow is to give it away.
Here it is: Ø
If you find a bug or want additional features, just submit a report and we'll fix it and issue a patch.