New Linux Kernel Crash-Exploit discovered

There's a big difference... by Allen+Zadr · 2004-06-14 01:07 · Score: 5, Insightful

Here is a perfect example of the difference between the Open Source way and a proprietary way.

There are goods and bads, however, the information is readily available. There are patches that "work", even before a full explanation is available. Now, thousands of people are actively working on a solution, if they so choose. If they don't choose, they can use the proprietary code method - wait for the official vendors to release a patch.

In proprietary land, a vendor would first sue the person who released the information. Then, the re-iteration that you won't be vulnerable if you use a "properly configured firewall," then they'd start working on a fix.

--
Kinetic stupidity has a new brand leader: Allen Zadr.

Re:There's a big difference... by garcia · 2004-06-14 01:12 · Score: 2, Insightful

There are goods and bads, however, the information is readily available. There are patches that "work", even before a full explanation is available.

This is how it always was. So? MS has plenty of patches out there for known vunerabilities (sometimes faster than others). Does it matter? NO. You know why? Windows users don't tend to care. They don't read Windows news sites daily, they don't subscribe to mailing lists that send out warnings as soon as a vunerability is found. They don't patch when Windows tells them to.

You know why? They don't care, they don't want to "break" anything, or they don't even know that the little icon in their taskbar is any different from their 1000 other ones in the tray.
Re:There's a big difference... by Donny+Smith · 2004-06-14 01:26 · Score: 5, Insightful

>Windows users don't tend to care.

Or "Windows users tend not to care?"

Incidentally currently I'm a (primarily) Windows user and I do patch (actually it's "install updates") when Windows tells me they're ready (if I estimate I need the particular update).

Claiming that Windows users "don't care" just because they're Windows users is incorrect, to say the least.
How can people mod that as insightful? Generalization like that should be discouraged as it is not constructive, but some actually reward it... Quite puzzling to me..
Re:There's a big difference... by Rectum2003 · 2004-06-14 01:35 · Score: 5, Insightful

What he is saying is that most Windows users are the masses that don't actually care. Other OSes don't have this problem due to the fact that they are mostly used by geeks that understand why it is so important to update your OS (any OS for that matter). Not to say that there are not millions of consciencious users (like you) who actually have a clue and know how to secure and patch a Windows machine, of course.
Re:There's a big difference... by bamberg · 2004-06-14 01:37 · Score: 2, Insightful

Yeah, the open source mentality at work - on day zero fo a vulnerability announcement, designate those offering free public computing as a "lame free-shell provider", and take them down, together with the users who depend on them.

This isn't the open source mentality and it's dishonest of you to claim it is. The following quote from the article:

"This exploit has been reported used to take down several "lame free-shell providers" servers (this is illegal in most parts of the world and strongly discouraged)."

indicates that there have been reports that the bug is being exploited, not that open source supporters are intentionally crashing other people's boxes.

Only open source people would be stupid and nasty enough to do this sort of thing - if any software company took down its clients on purpose, they'd get seriously sued.

This is obviously untrue. Windows bugs are exploited all the time -- the people doing that are not "open source people". Why would say something so obviously incorrect in a forum where you're not likely to fool anyone?
Re:There's a big difference... by Verteiron · 2004-06-14 01:39 · Score: 4, Insightful

Real simple answer to that; you are not a typical Windows user.

The vast majority of Windows users behave exactly as the grandparent post states. I know this because I deal with the results every day in my shop. I'd guess that 80% of the machines I see are in due to spyware and virus problems that could have been fixed with a patch available weeks earlier. More often than not, when I get these systems up and running, the first thing that happens is "*pop* Windows has downloaded updates and is now ready to install them." So the updates were already downloaded, waiting for the user to click "Install"... but the user never did, for reasons already mentioned.

Automatic patching on XP Home would be doing end-users (and the internet!) a huge favor.

--
End of lesson. You may press the button.
Re:There's a big difference... by garcia · 2004-06-14 01:40 · Score: 3, Insightful

Claiming that Windows users "don't care" just because they're Windows users is incorrect, to say the least. How can people mod that as insightful? Generalization like that should be discouraged as it is not constructive, but some actually reward it... Quite puzzling to me..

This is puzzling to you? Hmm, I am more puzzled by the fact that entire COMPANIES went down when some of the worms started spreading because of unpatched systems that should have been patched MONTHS (almost a year IIRC) before.

Now, if you are at a COMPANY and your system goes unpatched it's because the IT department there either doesn't believe the possible threat or does NOT care.

You read obviously read Slashdot therefore you are not a typical Windows user. You know about vunerabilities and even if Windows didn't tell you about them you'd still have an idea of what to watch out for (and possibly fix). My generalization is 100% dead on accurate. Most Windows users do not care, are afraid to patch, or just don't know.
Re:There's a big difference... by gfxguy · 2004-06-14 01:46 · Score: 4, Insightful

You get that impression but there are a lot of slashdot users, even ones that use Linux (like me) who will defend MS when appropriate.

That said, it does seem to be true that a Linux patch will appear a lot more quickly than an MS patch, and that seems to be a result of the fact that it's open source.

--
Stupid sexy Flanders.
Re:There's a big difference... by Kjella · 2004-06-14 02:04 · Score: 1, Insightful

Claiming that Windows users "don't care" just because they're Windows users is incorrect, to say the least. (...) Generalization like that should be discouraged

I agree perfectly. The proper generalization is "Users don't tend to care". System administrators do. And most people on slashdot are that, if not on more than their own machine. It tends to work a little better since admins under Linux have an easier time updating the systems, but the users don't care either way.

I think it's a lack of analogies - how often is anything else rendered unusable by not doing something? You can *not* maintain a car, and it'll eventually break down, but it takes ages. Not updated with last weeks patches? Whoops [AOL] You've got worms! [/AOL]. Keeping a computer up to date feels like polishing your car every weekend. Neither is fun nor interesting...

Kjella

--
Live today, because you never know what tomorrow brings
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:17 · Score: 1, Insightful

Who decides that?
Re:There's a big difference... by Anonymous Coward · 2004-06-14 02:19 · Score: 5, Insightful

Now, if you are at a COMPANY and your system goes unpatched it's because the IT department there either doesn't believe the possible threat or does NOT care.

dont play that game... 3 months before the big nasty worm that hit I was threatened with being fired because I patched all my systems with thew RPC hole patch... Not by my supervisor but by a bunch of jerks in corperate IT... after it hit and we were immune to the problems, did I hear an "I'm sorry?" or anything else? nope.. my boss bought me lunch that entire week and wrote a shining/gleaming letter to be put in my employment file... but corperate asshats refused to acknowlege that a nobody from the midwest division knew more than them.

Most of the problems in companies that got nailed with the RPC hole worms was ignorance and apathy.. they do things "their way" and ignore anyone below them on the totem pole.. until the fire starts raging...

My boss and many of us are starting to change corperate IT by throwing them under the bus at every chance.... It's the only solution we can see to fix the problem.
Re:There's a big difference... by RickHunter · 2004-06-14 02:42 · Score: 3, Insightful

Yup, and you know why? Because Microsoft tends to introduce arbitrary EULA or functionality changes in their patches. So with an autopatching system, you'd be agreeing to these changes implicitly. Whoops.
Re:There's a big difference... by allism · 2004-06-14 02:43 · Score: 2, Insightful

80% of the machines you see are in due to patchable problems....Does that mean that the whole world is mentally ill because 80% of the people a shrink sees are crazy? I would think that for the most part a computer doesn't end up in your shop unless there's a problem that the user can't fix - this does not mean that 80% of Windows users don't take care of their computers.

--
Denver Isuzu Suzuki
Re:There's a big difference... by peeping_Thomist · 2004-06-14 02:47 · Score: 2, Insightful

The vast majority of Windows users behave exactly as the grandparent post states. I know this because I deal with the results every day in my shop. I'd guess that 80% of the machines I see [...]

What makes you think that the majority of Windows users take their computers to shops for software problems? In my experience, the only people who do that are the ones too technically incompetent to solve the problem and too socially incompetent to find a techie friend to help them.

--
Anything worth doing is worth doing badly -- G.K. Chesterton
Re:There's a big difference... by nachoboy · 2004-06-14 02:49 · Score: 3, Insightful

Windows users don't tend to care. They don't read Windows news sites daily, they don't subscribe to mailing lists that send out warnings as soon as a vunerability is found. They don't patch when Windows tells them to.

You know why? They don't care, they don't want to "break" anything, or they don't even know that the little icon in their taskbar is any different from their 1000 other ones in the tray.

The observation you make is correct. The group you apply it to is incorrectly targeted. Do you suppose that if all of the sudden the vast majority of these Windows users migrated to a more favored OS, they would magically read relevant OS news sites daily, subscribe to kernel mailing lists, and patch when their OS told them to? Of course not. Users are users. They're not interested in OS news or maintenance any more than they absolutely have to be (which, given the nature of modern technology, is practically nil). The fact that most computer users run Windows is largely an artifact of business dealings, not some concious decision on the part of the users.

No, the way to solve such problems for the computer users of the world is by providing better defaults, ie, automatic patching turned on out of the box. If you're part of the tinfoil hat crowd, go ahead and turn off automatic patching. If you like to patch manually and can be trusted to do it, go ahead and turn it off. But if you're part of the unwashed masses, your computer just takes care of itself.
Re:There's a big difference... by maximilln · 2004-06-14 03:14 · Score: 5, Insightful

2) He thinks that security is a yes/no option. Security is nothing like that. If someone were to be honest with him, and tell him that nothing is truely secure and it's all trade-offs, and then explain the trade-offs of their particular product, I'm sure he would have thought they were weaseling, when in fact they were telling the truth.

AMEN!

It's a problem that I run into quite often and not just with security. When you come to understand a topic intimately enough you learn that there is very little in the world that's a yes/no option. Everything requires a level of expertise and must be tailored to the specific task at hand. The issue is that the people requesting the services don't know, don't have time to learn, and don't want to learn. They want the yes/no answer to keep their life easy. If you're the person attempting to sell your services in order to keep food on the plate, however, you're faced with a dilemma: Say "yes" and possibly get mired in a situation which is impossible (secure a network full of users who are actively trying to break the network), or say "no" and don't get the job.

--
+++ATHZ 99:5:80
Re:There's a big difference... by joeljkp · 2004-06-14 03:31 · Score: 2, Insightful

Yeah, because I read every line of code in every piece of software I install, just to make sure nothing gets in that I don't want.

Let's be real. He has good reason to trust the company about security information, and they have good reason to present accurate information. If the software fails and he gets hacked, they company loses business at best, gets bad publicity and a nasty lawsuit at worst.

You act like people wanting easy solutions is a negative thing. Not everyone is a security expert. That's why we have security experts. Specialization is the key to progress. The less time we spend worrying about things we don't care about, the more time we can spend on things we do.

--
WeRelate.org - wiki-based genealogy
Re:There's a big difference... by johnnyb · 2004-06-14 03:51 · Score: 2, Insightful

"You act like people wanting easy solutions is a negative thing."

It's not negative. It's the hubris that assumes that there _must_ be an easy solution, and whoever presents a solution and calls it "easy" must have found the right answer.

"Not everyone is a security expert."

I'm not saying they are. The point is that they assume that people who tell them what they want to hear _are_ security experts.

"The less time we spend worrying about things we don't care about, the more time we can spend on things we do."

This is true. However, we do need to know enough about the things we don't care about to make good decisions on them and know how it affects what we do care about.

--
Engineering and the Ultimate
Re:There's a big difference... by Allen+Zadr · 2004-06-14 04:30 · Score: 2, Insightful
I've been a Linux user for over 6 years, a UNIX Administrator for 8 years, and a Windows Administrator for 10 years.
If someone is determined to get into my machines (that means, without a script kit), then I am fully aware that all they have to do, is ask one of 80% of my users the right questions, and they'll have a password, through VPN or Firewall or anything short of GOD himself protecting my network, that person will get in. How's that for reality awareness?
In the mean time, the real-world issues that my users run into every day, tell me that I'm removing much more functionality than I am adding by putting in a firewall.
To complete your list;
1. Exploit
2. Announcement / Initial target identified, etc
3. Patch or Fix
4. Reverse info from patch and announcement turns into many varieties of script kit
5. Security awareness
6. CNN report about the casualties
7. The rest of the world (that knows how) starts to consider patching their systems, too.
I know that if my network is directly targeted by someone with both knowledge, skill and cunning, that they'll be able to break in. That's a reality that I can't control, simply because I have users.
When you say I'm new, I'd call you new. First is the discovery of computing, then is the technical side, and the geek stuff. Next is the realization that the geek stuff can be used to do nasty things. Where you are, is the realization that something should be actively done to stop it at all costs (sacrificing usability). Then there is multiple failures to realize the perfectly secure network (because of those damned user needs). Then, you will settle to where I've come to rest. Do what you can, don't sacrifice usability for security unless the security issue is critical and obvious (Clear and Present danger) - lest you have rogue users who will get the CEO to force you to bypass the rules.
Get smacked by a know-nothing CEO a few times then you'll realize that regardless of the size of the network, unless their security problems have been front page on the Wall Street Journal (rare), that security is not a priority.
What I do. Let every user know that I won't be able to get their stuff back if they let their computer get out-of-date. Let every user know what steps they have to take, weekly, to avoid the worst-case-scenario.
Other mitigating factors: 95% of my systems are laptops. They come and go on a daily basis. If they are not patched, the can and will come back with all the latest worms. In the last 5 years, I've never had a "new" worm successfully comprimise more than 2 computers. Every time, it's know-it-all users who think that the rules don't apply to them.
Otherwise, I could spend $250,000 (I'm not kidding on the price here) on security measures that would be quickly offset by a user lending his account info to a "friend". That's not to say that I ship systems with every possible service enabled. That's not to say that I think Mal-Ware won't happen (it has). But my incidents have been, in every case, less severe than companies around me where my friends work.
So, you can say I'm lucky, you can say that I've not presented a good target, that's fine. What I'm saying is that I live in the world where some 60% of people keep a key outside their house, but within 6 feet of the outside walls. You're only as strong as your weakest user, regardless of how much technology you dump into security. I choose to live out on the edge, and I've yet to be sorry about that decision.
--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by gfxguy · 2004-06-14 04:41 · Score: 2, Insightful

On the other hand, if you have a known vulnerability, then isn't it nice to have it fixed quickly (usually with the one liner you were talking about).

If there's a problem with that fix, another one will be along very quickly. It depends what you find preferable... leave your system open with a known vulnerability, or fix the known vulnerability with the possibility of opening a new one that no one knows about just yet.

It depends on your situation.

--
Stupid sexy Flanders.
Re:There's a big difference... by Anonymous Coward · 2004-06-14 05:15 · Score: 1, Insightful

I love people who think that production machines can be patched on a whim, not everybody works at Ma and Pa's convenience store "admin-ing" a POS system.

That's a failure of your IT department not the management. You need to explain to them what could happen and tell them that there is no choice. If you don't do that then the issues are your fault.

The original poster said that this is why OSS is so great. Patches are created before to long. It's obvious that Windows patches are created too. It's just that IT departments are too scared to tell off the management when they think they know more.

Quit being a bunch of whining babies and sit in your own LAN if you aren't going to patch. If you are connected to teh Internet you have a social responsibility to patch immediately.

I refuse to shed a tear for pussies.
Re:There's a big difference... by Kent+Recal · 2004-06-14 06:27 · Score: 2, Insightful

A *real* QA process, involving weeks of regression test passes and shedloads of machines.

So, is MS applying that *real* QA process?
If they do then it is obviously no solution to the problem.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 07:14 · Score: 2, Insightful

[Do] all your users require shell access?
No, and if they don't, wheather here, or in Mozambique, they can't get shell access either.
are they all familiar with strong passwords?
No, I assign the passwords, because I can't trust the users to do this. Yet, it's not difficult to get a user to tell you their password. It's sad, but true.
must all of your shell users be allowed to ssh from anywhere in the world?
If they need shell access, yes. This is rare though.
if many of your users have laptops that come and go from the building, just setup a seperate subnet for those users with strong firewall protection so it creates a separation between them and your critical systems. If I protect my network from my laptops, then I have only servers (and only 25 desktops) to protect. Then, I'm back to trying to use a personal firewall on every system we have. Check my other posts in this story to see how that's going. (not well).
after reading your reply, it is becoming clear that all of your backend network glue is all handled my Microsoft machines
Sadly, no. I only have a few Windows servers, all of my other servers run Linux (RedHat ES 2.1 and 3). However, 90% of my network is transient Windows XP laptops. All of the solutions that I can find are based on an Army of nailed down desktops that never turn off, and will always be able to quickly submit to the will of a domain controller.
if you think that usability is sacrificed because of security, then you really have a lot of learning to do.
Read this essay: http://www.fourmilab.ch/documents/digital-imprimat ur/
I found it quite interesting. And I find it's very easy to fall victim to this mentality. Why is WebEx the most successfull internet service company ever. Before two years ago, I used to be able to do software demos/desktop sharing and meetings with simple free software offerings. Now, due to firewalling, everyone has to pay WebEx for a really, painfully, simple service that used to be readily availble for free (NetMeeting, VNC, CUSeeMe, you name it). That's 0.30 to 0.50 cents per user per minute for something that should be free. Why? Because so many have freely and willingly sacrificed usability for security.
However, I would really be interested in any counterpoints. While others may think me a loud-mouth, I will listen, and on occasion will change my position if given a convincing argument.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by Allen+Zadr · 2004-06-14 08:10 · Score: 2, Insightful

A bad bug that can crash the kernel after a user has access. There are more than one active issues that can cause Windows to crash, especially if you introduce a specially compiled program.
This one is a particularly nasty bug, in that it can be caused by a user account. Windows hasn't had an issue like that since, Blaster, almost a year ago.
They are multi-threaded computer operating systems, they do complex things, neither is perfect. Neither will ever be perfect (although, Win 98 was really close before reaching End-of-Life). And Microsoft is not always the most evil of the software makers. RedHat, SCO, HP, IBM and Novell have all had there turn being raked over the coals on the pages of Slashdot.
I have certainly noticed a positive feedback curve with Microsoft. I'd like to think it has a lot to do with the community getting pissed off when it makes a bone-headed choice. Less focus on Open Source, naturally, because there are so many different projects. However, individual projects have been trashed here as well.
I specifically avoided the name "Microsoft", thinking more in terms of 'closed UNIX' vs. 'Open BSD and Linux'. But most slashers are desktop users, and in the desktop it seems that only Apple, Linux and Microsoft (list alphabetical) currently apply.

--
Kinetic stupidity has a new brand leader: Allen Zadr.
Re:There's a big difference... by WiPEOUT · 2004-06-14 12:20 · Score: 2, Insightful

The Windows "community", if you can call it that, is extremely diverse and disparate. The Microsoft-related communities are regionally- and/or technology-oriented. For example, the various VB forums on the web don't interact much with the COM/DCOM mailing lists, nor with the Host Integration Server 2000 newsgroup. The developer groups are very different to the admin groups, too. That's not to say there are no individuals that participate in multiple groups, but rather that the focus is different.

Also, on the various technical forums on the web, you will have "experts" of various grades proficient in Windows who help out people and each other, but this association is more to the goal at hand (eg. gaming, graphic arts, overclocking) or the community itself (eg. motoring enthusiasts, people living in a certain state) than the technology in use.

You may think this is somehow unusual, but since MS customers are interested in the products and what they can do with these products more than the philosophy of the company, it's not so hard to understand. Application developers will be interested in .NET, VB, SQL Server while sysadmins will look into Windows, Exchange, ISA. Sometimes there's cross-over, but even then the focus of developers looking into Windows internals will be different to that of the admins, and admins looking into SQL Server will not be looking into the aspects of SQL Server that most interest developers.

Professionals who work with Microsoft's technologies are simply interested in how it works, and what useful things they can do with it. Compared to the OSS community, there's little interest in non-technical discussion, and certainly a lot less interest in the individuals who head up technology groups. It's a more commercial association oriented around technologies than a technology association oriented about ideals.

These people are not anti-OSS any more than they are pro-Microsoft. They simply have had many different goals over the years, and Windows has enabled them to meet those goals -- often after a rocky road involving much learning. Some of these take to OSS solutions if given the occasion, and others are not interested in investing more time learning about technology, as they have higher priorities, or think the costs outweigh the potential benefits.

Shell: Ying-Yang of any OS by Anonymous Coward · 2004-06-14 01:14 · Score: 1, Insightful

"Using this exploit to crash Linux systems requires the (ab)user to have shell access. The program works on any normal user account, root access is not required. This exploit has been reported used to take down several "lame free-shell providers" servers (this is illegal in most parts of the world and strongly discouraged)."

Hope you all had a great weekend!

Re:OS bugs are like golf... by RAMMS+EIN · 2004-06-14 01:22 · Score: 4, Insightful

Well, those who have been paying attention know that Linux has had quite a few (read: way too many) critical bugs in the past year. Most of them were related to do_mremap (how many times do they have to "fix" that until its fixed?!), varying in severeness from DoS to local root exploits. How many has the Windows kernel had in the last 12 months? I am afraid that this comparison might fall out to the advantage of Windows. Until you take into account time to fix, maybe. Off to patch my systems...

--
Please correct me if I got my facts wrong.

so someone would by zogger · 2004-06-14 01:24 · Score: 2, Insightful

go to the trouble to get a paid for shell account at a provider, or a freebie I guess, then run this script, just to destroy their own account basically?

Or is the bigger danger is that this script would be the payload that is included within some linux worm?

Just wondering what this means for joe average home linux user who isn't running a server.

Re:Who has shell access? by Welsh+Dwarf · 2004-06-14 01:25 · Score: 4, Insightful

Sourceforge?

--
Ask 8 slackers a question, get 10 awnsers (a citation, but I can't remember from who)

Re:Fixed quickly. by bdash · 2004-06-14 01:26 · Score: 3, Insightful

And fixes will be deployed within hours.
The same cannot be said of many proprietary OSes...

The fact that a patch is available doesn't mean that it is a non-issue. In many cases system administrators are too busy, lasy or do not wish to interrupt services, to update their systems to fix these software vulnerabilities. The proprietary vs. non-proprietary argument is irrelevant if administrators fail to keep up-to-date with security fixes. A good example of this was the SQL Slammer worm that made it's rounds several months after a patch that fixed it's attack vector was released.

Simply put, the bigger problem is with the wet-ware than the development methodology.

I know plenty who do... by Allen+Zadr · 2004-06-14 01:29 · Score: 4, Insightful

I know plenty of users who do care...

In the real world, where I work, I run a Hybrid network where I'm still waiting for Windows XP Service Pack 2 to come out in a finalized form because I don't have an option to pull just the parts that I need, and SP2 RC2 is not quite ready to unleash on my network (although I have actively TESTED it). Of course, this just fixes some vulnerabilities that have existed for over a year.

Don't tell me that I, as a Windows User and Administrator, don't care. While I've ignored this kernel issue over the weekend, I get to actively compile come kernel patches and test those. I'll bet, even before my testing, that I'll be able to have a production solution by tomorrow. Even if SP2 releases this afternoon, I'll still have to test it before deployment, so the Linux solution will be in production first.

--
Kinetic stupidity has a new brand leader: Allen Zadr.

Re:This is another reason why C should be deprecat by codesurfer · 2004-06-14 01:30 · Score: 1, Insightful

I myself program in a variety of languages, and while each may have it's uses, I'm afraid I can't agree with your assessment. I generally use C++ over C most of the time, but I would certainly stick with C over VB (and yes, I do program in VB as well, when the occasion requires.). Just beacuse a language has an impressive GUI does not make it more valid. In fact, it can often increase the chances that a programmer is churning out code without truly understanding all that it's doing. Just my two cents, of course.

Re:This is another reason why C should be deprecat by Morgahastu · 2004-06-14 01:30 · Score: 1, Insightful

I think this is a joke but with the amount of idiots out there it's hard to be certain.

Re:This is another reason why C should be deprecat by Anonymous Coward · 2004-06-14 01:31 · Score: 1, Insightful

As I will explain, I feel that C needs to be retired, much the same way that Fortran, Cobol and Perl have been.

I know this is a cut and paste troll, but for best effect use 'PERL' instead of 'Perl' or 'perl', makes you sound even more like you are talking out of your ass.

Thanks!

You have a superb feeling about this level! You sense the presence of monsters!

###### #...@+TTTTTTTTTTTTTTTTTTT #....# ###### You hear a door burst open! You die (more)

Re:Who has shell access? by AllUsernamesAreGone · 2004-06-14 01:33 · Score: 2, Insightful

I don't know how "real world" you'd class a University, but there are two machines I have to help out with here that students have access to for their Bioinformatics DL assignments.

It already has a program running on it that I had to develop to detect processes using too much processor time and kill them (with warnings, messages printe dout when students log in and so on). I'll probably have to upgrade it to do the same with memory now that we have one genius who seems to be finding a way to consume 1.8Gb of memory.

Now I need to get kernels compiling, excuse me...

Know what else by Anonymous Coward · 2004-06-14 01:36 · Score: 4, Insightful

As for this bug, don't start bashing Linux left and right. Linux isn't perfect, no software is. But unlike when there is a bug in windows a fix is on the way as fast as possible. In fact, there is a patch on the site right now! And for you zealots who say stuff like "No big deal, who is going to do that? No the kind of person you give shell access to." shut up. Admit that Linux is not the perfection in computing.

You know what else makes the kernel crash? At least if you are using 2.6.5 or higher if you enable APIC/APIC-IO and you have an nforce chipset the system will lock up as soon as you do too much I/O.

Re:Okay, I'm confused... by Secrity · 2004-06-14 01:37 · Score: 2, Insightful

And FreeBSD patch day is the first Tuesday of every quarter (if needed).

Re:The best way to avoid this bug by TheRaven64 · 2004-06-14 01:41 · Score: 4, Insightful

The question is not when it will be modded down, but who will do the modding. Will it be:

Linux zealots moderating it down because it suggests that you buy a Mac, or
Mac zealots moderating it down because it suggests you don't use OS X?

Gentlemen, place your bets now.

--
I am TheRaven on Soylent News

Re:This is another reason why C should be deprecat by Tenareth · 2004-06-14 01:44 · Score: 3, Insightful

I guess everybody missed the sarcasm.

--
This sig is the express property of someone.

Re:Who has shell access? by 42forty-two42 · 2004-06-14 01:48 · Score: 2, Insightful

It already has a program running on it that I had to develop to detect processes using too much processor time and kill them (with warnings, messages printe dout when students log in and so on). I'll probably have to upgrade it to do the same with memory now that we have one genius who seems to be finding a way to consume 1.8Gb of memory.

Don't kill it, renice it. It'll still run, but it'll cede the processor to other apps when they need it. Also, ulimit can handle limiting memory.

NetBSD? by Anonymous Coward · 2004-06-14 02:02 · Score: 1, Insightful

The article mentions "This doesn't affect NetBSD Stable." Why would a Linux Kernel flaw effect any version of *BSD?

Re:Fixed quickly. by petabyte · 2004-06-14 02:05 · Score: 2, Insightful

This bug was posted on slashdot as a comment reply to the Assembly programing article a few days ago. I looked at it then and it locked up my machine nicely.

Aside from that, I don't know that your point is valid. Most linux users either know how to use patch and compile their own kernels, or can run up2date or whatever to download their latest prefab clutter. Also worth pointing out is this bug needs a shell to run the program and crash the system. If you're giving out shells and don't know how to use patch, this is the least of your worries.

The patch is linked from another comment in this thread and yes, you'll have to recompile your kernel. No one has access to my machines here but me so I'm not going to bother updating until 2.6.7 is released. Have a good one.

Re:This is another reason why C should be deprecat by julesh · 2004-06-14 02:17 · Score: 2, Insightful

Did you actually read it? I think it was the best troll parody I've seen for a while. I mean, the author clearly understood exactly what he was talking about when discussing C's support for pointers, which means that the way he missed the point and described them as 'inefficient' is marvelous.

Also, in light of recent events concerning the ADTI 'Samizdat' book & the author getting Tanenbaum's nationality wrong, describing Linus Torvalds as a Swede is a masterstroke.

Re:A good time to disable compiler access by PoochieReds · 2004-06-14 02:31 · Score: 5, Insightful

This does no good if someone builds the program on another machine and then copies it to your host. Limiting compiler access really doesn't help secure anything unless you also prevent anyone from transferring any files to the machine (which is quite impractical).

Re:A good time to disable compiler access by Sloppy · 2004-06-14 02:35 · Score: 5, Insightful

Having a local compiler available makes things easier, but it doesn't give a user any fundamental powers that they wouldn't already have. They can get executable code into the system in other ways, even if they don't have a local compiler. Transfer it from another computer, or even manually enter it. Are you also going to disable cat and chmod?

I don't think this idea is useful.

--
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.

Another fallacy of Open Source by glorf · 2004-06-14 02:47 · Score: 2, Insightful

There are patches that "work", even before a full explanation is available. Now, thousands of people are actively working on a solution, if they so choose.

So who is serious enough about security to want this patched, but stupid enough to just accept a patch from any of thousands of developers? Yes you could evaluate the source of each patch and recompile using th new code, but who has time for that? Open Source and proprietary software are no different in terms of patches. If you don't get it straight from the horse's mouth then you are not following very good security procedure.

After all, doesn't anyone remember this? You can find open source patches for proprietary software every once in a while too, but you would be nuts to trust them.

Re:Although Windows is Easier to apply patches to. by alexbartok · 2004-06-14 03:12 · Score: 2, Insightful

If you maintain a Linux system for a larger group of people, you should know what you are doing. Pardon me, but obviously you're not.
As soon as I read this I upgraded our Firewall at work. I downloaded the latest 2.6, got the patch from the bottom of the linuxreviews site. That took about 4 minutes on a somewhat fast internet connection.
Extracting the Kernel and patching it: 1 minute, brain involved: none (patch howto on that page as well, besides, if you are a real sysadmin you'll be able do kernel patches single fingered).
Configuring the kernel: 1 minute as well, using make oldconfig (porting over my .config from 2.6.4, then answering a few questions for new options) brain involved: 1%, well documented in case of doubt.
Compiling: make-kpkg kernel_image: 10 minutes, brain involved: 0%.
Installing: dpkg -i ../kernel....: 10 seconds, brain involved: 0%.
Rebooting: about 1.5 minutes, brain involved: how fecking hard can it be to type 'shutdown -r now' ? or maybe even 'reboot' :P

This also answers the other posting where somebody was whining about making the updates moronproof... Most distros have this 'feature', autoupdating, Redhat: up2date, Debian: apt (through security.debian.org), ...

Re:This is the best they can come up with? by BenjyD · 2004-06-14 03:34 · Score: 5, Insightful

This is a reasonably serious bug. A well-configured *nix box should not be crashable by anything a normal user can do. The amount of memory a user can allocate, the number of processes they can launch, the size and number of files they can create should all be limited through user limits. There is no way (AFICS) to prevent this bug being exploited through those kind of limits. If there are lots of people logged in, figuring out who crashed the box would be quite hard - just have the crashing program delete itself before it crashes the box.

Hitting ctrl-alt-delete or the power requires physical access, which shell users almost never have (I don't even know where most of the computers I use every day are - they could be in Timbuktu for all I care).

You forgot a few steps... by leonbrooks · 2004-06-14 12:22 · Score: 2, Insightful

For MS-Windows:

-4. Wait six months
-3. Deny that there is a problem (or assert that it is "theoretical");

-2. Sue or at least threaten to sue the people reporting it;

-1. Produce a fix that breaks several other things;

0. Produce a fix which only breaks a few other things but which silently rewinds some earlier security patches;

For Linux, choice of:

A. Download the vendor-prepared kernel within a few hours of seeing a problem report, install and reboot;
B. Download and apply a patch, then "nice rpm -bb kernel.spec" so the compile doesn't bring your machine to its knees the way it would under MS-Windows, install the results and reboot (with variants for non-RPM distros like Debian and Slack) (and what sort of nutcase would do the rebuild on a production machine when their own desktop would do the job just as well, even if it was a G5 and the target an Athlon64?);

C. Download and install a library shim which blocks the offending action, then do A or B without the reboot.

I'd like to see a TwoKernelMonte variant for SMP which allowed you to isolate one processor from the kernel, bring up a patched version of the same kernel under it in cooperation with the running kernel (which process would presumably not survive any changes in in-memory structures, so check for that first), migrating devices across in idle moments, then finally deleting the old kernel and bonding the processor thus freed to the new kernel. Viola, new kernel sans reboot. Ideal for a patching situation.

--
Got time? Spend some of it coding or testing

Slashdot Mirror

New Linux Kernel Crash-Exploit discovered

49 of 691 comments (clear)