Slashdot Mirror
OpenBSD Vulnerabilty
*no comment* writes "Normally vulnerability reports on slashdot wouldn't make it because there are so many. This one however is for the normally very secure OpenBSD. Someone can crash an OpenBSD bridge using a newly discovered ICMP exploit. More can be read here. This shouldn't affect most people as this only affects people that use OBSD as a bridge."
slashdotted already?
Obligatory "No remote exploits in 0 days."
Normally vulnerability reports on slashdot wouldn't make it because there are so many
This might be unusual but it's really not that big a news. I suppose it shows that even the best are not infallible. Nice to see it's already been patched =).
Normally vulnerability reports on slashdot wouldn't make it because there are so many.
That is, unless it's a vulnerability in Microsoft software.
Here:
i cm p-payload-00.txt
http://openbsd.org/errata.html
"All architectures
016: RELIABILITY FIX: August 26, 2004
As reported by Vafa Izadinia bridge(4)
with IPsec processing enabled can be crashed
remotely by a single ICMP echo traversing the
bridge.
A source code patch exists which remedies this problem.
015: RELIABILITY FIX: August 25, 2004
Improved verification of ICMP errors
in order to minimize the impact of ICMP attacks
against TCP.
http://www.ietf.org/internet-drafts/draft-gont-
A source code patch exists which remedies this problem."
Nevertheless, I still like its excellent record
in security stat's... OpenBSD, here I come...
11:55:08 <Niels> OK, man, whatever you say. So who submitted the bug report in the first place?
11:56:23 <Theo> Who cares? It's B-O-G-U-S! Now leave me alone, can't you see I'm busy?! 11:56:29 <Niels> Jeez, would it kill you to give me the details on this alleged bug?
11:59:51 <Niels> Theo? Are you there, man?
^An^Ap
12:00:00 *** Signoff: Theo (Read error: EOF from client)
^^ typed in shock in an attempt to do a
Because the worst you can do with it is crash the system, not gain access.
For the uninitiated: BSD is a free, completely legal flavour of UNIX developed at UC Berkley, rather than a unixlike OS.
But then if you're reading posts for a BSD you probably already know that
You forgot Darwin/BSD among that lot.
Clearly the parent has been in the security or networking business for more than a few years.
In fact, I recall when RH7.0 came out and was followed almost immediately by 7.1 because of so many remote holes. I've seen several friends have their Linux boxes rooted, and I'm moderator on a Linux forum where we get at least one person a week (some times one a day) asking how they can repair their system because it was cracked.
On the other hand, none of my OpenBSD boxes have ever been cracked... come to think of it, none of my Windows or Mac boxes ever have been, either.
Someone is WRONG on the Internet!
None of my Windows boxes have ever been rooted, either. What's your point? You can secure any OS, so what's really important is the default state. Someone who immediately connects a box with Red Hat to a network will get rooted just as fast as someone who connects a default install of Win2K.
Someone is WRONG on the Internet!
Since when does "security" mean "not letting anybody gain access"? "Security" means eliminating risks. Somebody crashing all your routers counts as a risk in my book.
Since when does "security" mean "not letting anybody gain access"? "Security" means eliminating risks. Somebody crashing all your routers counts as a risk in my book.
Denial of service, by itself, is never a security risk. It might contribute to one, but by itself it is not.
Even in the real world, if you close down a building to prevent someone from placing a bomb, the building is secure. None of the usual business gets done, but it's still secure because the bad guys stay out. A traffic jam right outside your house will prevent you from leaving, but your home is still secure. Your money is still secure on a bank holiday.
Security is about keeping unauthorized people from gaining control of your resources. Merely stopping you from using them does not count.
Security is about keeping unauthorized people from gaining control of your resources.
Restating it doesn't make it any more truer. You do realise that you just ignored what I said entirely and repeated the original mistake without anything new to add, don't you?
Security is about keeping your systems secure. "Secure" does not mean "unauthorised people can't get access". "Secure", in layman's terms, means "safe". That's safe from unauthorised intruders, safe from denial of service, safe from floods in the location of your servers, safe in the event of fires, hurricanes, etc. Safe. That's what secure means. Go and look it up in the dictionary, or, even better, take a few computer security courses.
It's not just about script kiddies. That's the mistake I pointed out, and it's the point that completely went over your head.