Slashdot Mirror
FreeBSD Kernel Leak
Pine Digital Security announced a FreeBSD kernel leak, found when auditing a customer. The leak can be exploited to panic the server or elevate privileges. FreeBSD swiftly updated CVS, a security advisory will probably follow. Both the -RELEASE branch and -CURRENT branch are vulnerable.
Ah 100% security doesn't exist
I just wanted to point this out since whoever
submitted the article didn't feel it was
necessary.
To repeat myself, according to the article, this
problem does not effect OpenBSD or NetBSD.
*sigh* back to work...
Remind me to stay of EFNet tonight....
1. Find a panicky-looking bug report in your Slashdot submit queue
2. Post the link immediately with a stupid CVS link, without waiting for the official FreeBSD security advisory, without having even a simple fix for -STABLE. Pine's advisory has not even reached Bugtraq yet! We can be lucky that Pine does indeed not release exploits!
What kind of editors are you? Yes you were first with this story, and Pine offers it, so it's officially out. But who can do anything right now? Yesterday we already read that royal screwup about IE's correct HTTP1.1-compliance. Another example of worthy news-editing..
bsd is dead even with apples expensive junk why not just run linux wehre all the good progs are running even M$windoze gamez and stuff some people just want to be different and cool and make there live ahrder then it should be!!!!!
"FreeBSD swiftly updated CVS"
I love open-source.
Where in the story posting does it say that involves NetBSD and/or OpenBSD? It states clearly that it's a FreeBSD bug. And one that's already fixed in CVS to boot.
It looks like there's plenty of security flaws in the OSS world too.
there ya go, fuckhead.
Key phrase:
"The leak can be exploited to panic the server or elevate privileges."
My operating system hasn't had a remote privilege violation (let alone root exploit!) or DoS exploitability in 27 years.
MS-DOS. No remote root exploit in 27 years.
i appreciate postings like this, but as usual, any good discussion about the problem is zero on slashdot.
every time there is a mention of linux or xBSD or whatever OS having a problem, people who don't use it come out of the woodwork to say "LOOK! It sucks! It's broken! HaHaHa! We Win!".
how old are you people ? (mentally?)
no wonder why other tech-based sites have no respect for slashdot discussions.
But then again, who'd want that source anyways?
Is this the reason that Rackspace would not let me use FreeBSD on their network 6 months ago? They said that if I use FreeBSD then I will be hacked. Then they pushed RedHad Linux on me.
To this day, I do not know why they said FreeBSD is insecure at the Kernel.
The above is not worth reading.
Kernel's leak YOU!!!
Why was this even posted? First Slashdot posts erroneous stories. Then they start making up stories. Now they post the most trivial of stories.
"Ho hum. Another slow news day. Let's roll some dice and post a minor random security advisory from some random project and pretend it's news."
A Government Is a Body of People, Usually Notably Ungoverned
This is a local vulnerability; it doesn't, in and of itself, make servers vulnerable. Even if someone has a local account on a system, it takes hours of CPU time to perform an exploit.
It looks like the bug (and the fix) were already announced (and committed to CVS) but that the possibility of using the bug in an exploit was not revealed until now (and might not even have been appreciated by the original reporter).
The problem is already fixed, and people just need to update themselves now.
This is absolute proof that FreeBSD is dying. LOL LOL I USE AOL! My god! Why am I trolling of slashdot? My life is so pathetic that the only joy I get is taunting others about an obscure OS on an obscure website. Actually it isn't even my joy, I'm just guessing that is what a trollers joy is. I was just was disapointed when I didn't see any *BSD is dying posts on this thread so I made this.
Note: The opinions expressed within do not represent AOL Time Warner or OSDN. They are the opinions of Cowboy Neal.
Ya know Ed you da man! I was pretty sure it was local and not the average script kiddie's folly; however, wanting to see how long it took for someone to confirm my drunken belief and now I am way down here in the replies :).
:) )
Begin_Rant
Too much wah wah FreeBSD, Not OPEN or NET blather to give people, who may need direction and are unfamiliar, the proper support and information they deserve --hats off to you for pointing the truth out.
Afterall, it's the community spirit being fostered by the BSD and Linux and Open Source Movements that needs to be agressively passed along to the newly initiated cause we all know....
The DOCUMENTATION SUCKS, so the community needs to make up for it, or we'll all have Borg implants, M$ alarm clocks that don't wake us up for work, microwave ovens that can't cook a decent buttered popcorn, and Oracle poptarts that are still cold out of the toaster.
Having a choice makes up for small road block which are already fixed and gone.
Surely some people have a few production servers will probably need to be patched against this due to the service that they provide, but the odds that they'll get caught with their asses hanging out are slim to none and even the slightest of process monitoring would smell that in a hearbeat.
Any OS needs help out of the box and takes a clear and goal oriented approach to make it secure and tuned in any sense to the mold in which you want it to fit.
Too bad people would rather speak than what consider what people may want to hear....It obscures the point. I think the post meant well, but was the starting point of a degraded dialogue (minus my $0.02 of course
End_Rant
-Quillsta
Command attempted to use minibuffer while in minibuffer
You did a nice job of writing something that went over most people's heads there :)
No, your children are not the special ones. Nor are your pets.
The word you were looking for was affected, not effected.
Stupid geeks and their third grade english skills.
Are you completely sure that no network daemon can be coerced into calling fpathconf() repetitively?
The problem isn't calling just calling fpathconf() repetitively. The problem is calling fpathconf() repetitively on a socket or other non-file (which would be a bug in itself). And by "repetitively" I mean at least 2,147,483,648 times on the same file descriptor for a system panic exploit, and exactly 4,294,967,295 times on the same file descriptor (followed by a close()) for the priviledge escalation exploit.
No network daemon that is part of the FreeBSD base system can be coerced into performing the necessary actions. Grep the source tree yourself (you'll only get a handful of hits) and examine the resulting files if you don't believe me. It's impossible to rule out everything in the ports collection (and the FreeBSD folks are careful not to make any claims regarding them) but it's hard to imagine creating an exploit of greater than theoretical importance using any network server.
> Although the missing fdrop() call in fpathconf(2) was noticed
:)
> before by Nakamura Takayuki its impact
> was severely underestimated.
As someone noticed before, it looks like a known bug, but until now nobody has really done the check, "hey, what this bug does?".
Maybe now the FreeBSD Core team knows why they fixed the bug
Cesar Cardoso can be found at cesar at zyakannazio dot eti dot br (or at least I believe so)
I mean if we are going to be retarted and point out the obvious..
Neither is Mac OS's affected either
One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.
You don't need to be a Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.
FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.
Let's keep to the facts and look at the numbers.
OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.
All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.
Fact: *BSD is dying
> how old are you people ? (mentally?)
> no wonder why other tech-based sites have no respect for slashdot discussions.
I'd say that that's what's so great about slashdot, its egalitarian nature. Sure, you see many stupid posts (you might say that this post is stupid as well), but the fact that anyone can contribute to slashdot makes this place magical and dynamic; stupid posts are just a minor consequence. And let me ask you; if you think that slashdot is just a morons and idiots get-together, why would you be reading and posting here?