Sun Security Patch Introduces Security Hole

Rich0 writes "Sun is announcing that their 'Security Hardening Package' for their Cobalt RaQ 4 Linux servers allows remote users to execute arbitrary code. Ironically, the solution is to remove the package, potentially removing protection from other compromises. There's a CERT advisory, as well as an article posted on Extremetech." Yikes, one would hope there's a forthcoming patch in the works.

Comments

Yet Another Reason No One Takes Linux Seriously

[SuperDuG]

Well take a look people...

MS: doesn't release bug fixes because their are no bugs. Only security updates and service packs to appease people.

Sun: releases a bug fix with an even bigger bug.

Linux: released bug fixes quickly.

And that's it, linux will forever be in last because of the fact they can't follow simple rules. You would think that everyone had a copy of Linux's source the way bugs are spotted and fixed so quick .. sheesh. Perhaps we should try and sell the source of linux to India?

PS - that was sarcasm ...

Man speaking to cylist by roadside

[kfg]

"What on *earth* are you doing there?"

"I'm ripping the patch off this inner tube."

"You're taking the patch off? Whatever for?"

"Well, you see, it's got this big hole in it."

"Ummmmmmmmm, are you *sure* you know what you're doing?"

"Don't worry, I can patch the patch when I get home and then nail it back on."

KFG

we cobalt owners call this par for the course

[kraksmoka]

as a proud owner/admin of a Cobalt Raq2, i'd like to announce that this is not the end of the world to us, no matter how bad it looks on the front page of /.

that particular machine runs a custom rolled distro of Red Hat 6.2 and has been known to be very reliable, and have mild issues from updates. every one of the holes it covers has some sort of workaround, which those admins have probably employed already.

i'd like to take this opportunity to complement the Cobalt Raq Users List members as well. without people like bruce timberlake, jeff lasman, steve werby (a /. contributor) and a whole host of others (can't name everyone) the raq has a vibrant community of admins willing to help even the newbiest of owners.

my machine runs on a lovely 64-bit mipsel processor from MIPS and is one of the dutch (sun bought cobalt a while back, it started on the other side of the pond) original models. they are tremendously power efficient, quiet and dependable boxen. mine uses a dinosauric 2.0 kernel and modified red hat 5.1 , and runs php 4.1.2/mysql like a champ.

not only that, but the cobalt raq IS a web appliance. In other words, its not really meant to do all that out of the box (back then anyway). today's raqs run a full gamut of oss and free software, and come pre-installed with everything you need as a webmaster.

it is an oustanding machine for NT admins to learn how to switch over, with the cushion of a working system to learn from.

yes, sun doesn't always get it right, but they put their backs into it so to speak, and it is not unusual for a Cobalt engineer to post solutions (even unofficial ones) to the list.

for all you cobalt users out there, you know what i'm saying, and if you're not on the list, you're missing out.

this post has voided your warranty. peace.

There is a patch already

[lifeless]

Has *anyone* actually read the SUN announcement.

I quote:
===
5. Resolution

This issue is addressed in the following releases:

Intel

* http://ftp.cobalt.sun.com/pub/packages/raq4/eng/Ra Q4-en-Security-2.0.1-SHP_REM.pkg or later
===

Re:There is a patch already

[mccalli]

It's not a resolution - it's a removal procedure for the flawed patch. There's no replacement in functionality for the original.

Cheers,
Ian
(Raq 4 owner)

Re:Wow!

[Black Copter Control]

The problem isn't just that you can't trust a specicificpiece of bad software. It's that -- because of the rather cockeyed way that microsoft did their DLL 'support' -- there's no way that you can just pull trust for that piece of code, or otherwise prevent it from being downloaded without removing trust for everything made by microsoft.. This leaves users in the rather wierd position of either not being able to download *any* MS active-X control (for fear that it could be the bad one) or leave themselves open to the possibility of somebody trojaning in the bad 'trusted' control and then owning your machine up kazoo..

The problem with this Cobolt 'security' release is one of a flawed implementation. Microsoft's bug was one of tragically bad design. The latter is much harder to work around.