Slashdot Mirror
DJB Announces 44 Security Holes In *nix Software
generationxyu writes "D. J. Bernstein, better known as DJB, has announced the discovery of 44 security holes that were found by students in his course MCS 494: Unix Security Holes this fall at the University of Illinois at Chicago. Vulnerable programs of note include: CUPS, NASM, mpg123, MPlayer, xine-lib, and numerous others. Copies of the notification emails are here. The homework for the course was to find and exploit 10 previously undiscovered security holes in currently deployed Unix software. In a class of 25, 44 security holes seems a bit low. Most of the class failed. I was credited with bsb2ppm (actually libbsb) and jpegtoavi. After 300 hours of work and an A average on the exams, I expect to fail the course."
As much as I respect profs who are willing to push you to do neat things (finding 44 holes in UNIX and it's standard set of programs is nothing to sneeze at), if you really do fail the class I'd take this straight to the administration. They're letting you down by allowing a professor to fail an entire class, especially since the grades are based on something that doesn't really reflect your understanding of the subject.
I've always had a problem with this sort of behavior in college profs -- it gets away from what I consider to be the basic nature of higher education. As a student, I'm the consumer. I'm paying the professor to teach me what he/she knows and then to rate how well I've absorbed that information at the end of the class. Assignments such as this one or classes which are set up as "cut down classes" just aren't consistant with that.
It works the same way on the other end; I had a few professors in college who would cancel class on a fairly routine basis. Hey, I enjoy the odd day off as much as anyone else, but I'm paying a lot of money based on the assumption that I'm going to be getting something in return -- if I were to subscribe to a magazine and then only get 2/3rds of the issues, do you thing I'd be within my rights to object? Hell, the overly easy classes were bad enough; I actually had a few that graded based mostly on attendance. Yeah, getting the most for my tuition dollar there.
Anyhow, I know there are folks out there who are going to disagree with my view of a University education, and that's fine, but regardless I would really encourage you not to accept this lying down. I know as a student it often seems like you're powerless, but if 25 of you (and your parents -- I know you're an adult, but schools listen to parents) get together and make yourselves heard, you'll probably end up with a satisfactory outcome.
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
He pretty much gave them free reign. ANY OSS at all!
Have you seen CPAN? Half of that code is something someone hacked up in a day! And what about all those sourceforge projects that have one developer and less than 10000 lines?
Meanwhile, almost every piece of code that this class is looking at is stuff that's already had a once over - heck, probably even been looked over thousands of times. No wonder they couldn't find any bugs. They were looking in the houses, not the motels.
Mod me down and I will become more powerful than you can possibly imagine!
The problem is that many of the profs have no professional experience outside the academic realm. None. Amazing as it sounds, they go from graduate work to post-doc to the faculty lounge, all the while succesfully avoiding any opportunity to deal with people as equals...its always grovelling to someone or getting someone to grovel to you. Its no coincidence many sleep with their students, its often the only way they can get laid.
The dynamics of academic environments are truly absurd, I'm amazed more of them are not murdered.
Enrico Fermi supposedly failed every single person who ever took his Quantum Mechanics course at the University of Chicago. A special footnote had to be added to transcripts as a result.
The pity is that such a strategy allows for no differentiation between people who are working at their full capacity and goof-offs who sleep though class.
The better approach is to create one or more large files of random data and feed that into the apps; this is better because it gives you a reproducible stream. (Or you can use a Perl script with a known srand() seed.)
The term "fuzz testing" comes from a seminal 1990 paper (and followups in 1995 and 2000) by Barton Miller et al., who, incidentally, found much higher quality in GNU tools than in their proprietary counterparts. Before my tendinitis got too bad, I used to run The Bulletproof Penguin a one-man project devoted to stamping out such bugs (my initial goal, easily achieved, was to eliminate all the bugs reported in the original paper). Ben Woodard was doing something very similar for a while, but I don't know whether he still does.
Incidentally, this makes a certain recent Slashdot story more embarrassing: it seems that free Web browsers crash on malformed input, the kind of case that free software normally handles better than its proprietary competition.
``Life results from the non-random survival of randomly varying replicators.'' -- Richard Dawkins
I've reported 4 stack/pointer based crashes in Konqueror in the past couple of days and they just came to me without looking.
If I could have crafted an exploit for the crashes then that would be 4 holes.
All the students needed to do was look at the current/recent bugs list for a version of software.
Identify bugs that could possibly be exploited. (say maybe 100)
Run automated buffer/stack exploit
checking software against those bugs.
hope to get 10 criticals.
Khtml's probably a good choice for exploiting at the moment, as it's getting a lot of 'features and fixes' which probably caused the crashed I've reported.
thank God the internet isn't a human right.
That kind of stuff usually doesn't work. In an Astronomy class (toward an Astronomy major, not that gen-ed crap) the professor did not tell us we would have to remember constants, and he asked them as questions. They were short questions, and weren't worth a lot.
One of them was: What is the orbital period of Saturn? (2 pts/100)
I started thinking about Bode's law and the posibility I could calculate it from an approximate radius I would get from that law... if I could remember it. But when you expect a 72% to be an A on a test, you have bigger fish to fry.
Then I got it. It was right, it should work, and no one would have to be nailed to anything.
I wrote: One Saturn-Year
I didn't get credit for it. A couple years later a sophmore was telling me about this funny question he had in the same class. He showed it to me. It read:
What is the orbital period of Saturn? (Do not put one Saturn-Year)
I was so right that it had to be guarded against. Yet those were 2 points I would never have.
Others are pretty implausible, for instance the jpegtoavi exploit, which requires the user to run the jpegtoavi program on a set of files provided by an attacker.
On my quick perusal, the nastiest holes seem to be the changepassword hole, a local root exploit, and the two holes in cups, particularly the first one, which straightforwardly gets the attacker access to user "lp" where they can monitor everything that gets printed.
One thing that is a bit surprising and disappointing is that so many of these bugs are from well-known bad coding practices. Why the hell is *anyone* still using strcat in distributed software, for instance?
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
Mine was modifying a string constant in Borland's Turbo C by setting a pointer variable to the begining of where the constant was stored and then changing the proper offset. When I got my test back, it said "-5, +5, I tried it it worked!". I was too much of a stupid kid to realize that you shouldn't write self modifying code in the global constants table.....
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
As one of the mplayer developers, I would like to thank to DJB for giving us (hmm)16 (?) hours before unleashing exploints on wild.
Maybe he is not aware that making right fix, testing it and finally releasing it, is not so simple task. Especially if we have to convice the person that have release (write) permisions, that him girlfriend is not as importan as the security release:)
Not to say, that I still haven't got the mail in my mailbox, despire that gmame shows it have been recived.
Also mplayer-dev-eng@mplayerhq.hu is the more appropriate maillist to send security issues. (MPlayer documentation will be updated accordingly.)
The exploit that is found in MPlayer is not alone. There are at least 2 other places with similar exploitable bahavioud in the same file. I guess the students keep them for next semester.
BTW code originates from Xine, probably it is time to update our version ;)
>1. Prof says 'I'll fail you if you don't perform a near-impossible test.'
>2. Student says 'OK.'
Nope.
Student weighs factors, realizes that if he takes the test, he'll probably fail the course. FAILING THE COURSE MEANS NO CREDIT HOURS, AND LOSS OF THAT TIME TO TAKE A DIFFERENT COURSE. Therefore, with regret, he takes his second choice for that slot.
Yes, Mr. Recruiter. I got an F in a course in my chosen major, but it was in an *impossible* course. Actually, between the presence of that F in the major field, and what it did to his GPA, he probably won't even get to see the recruiters he most wanted to see. He would have been weeded out before then.
The learning is great, sure. The impossible grade is serving absolutely nobody and nothing except DJB's ego.
The living have better things to do than to continue hating the dead.
Been there, done that, reported it, fix still not in qmail (as far as I know). You don't get the reward if the bug is an interaction between qmail and the os. I don't run qmail because of that issue. I could care less if the core code is secure unless its interactions with its enviroment (what ever that may be) are also locked down.
And I agree with user 820979.
Sir Ernest Rutherford, President of the Royal Academy, and recipient of the Nobel Prize in Physics, related the following story.
Some time ago I received a call from a colleague. He was about to give a student a zero for his answer to a physics question, while the student claimed a perfect score. The instructor and the student agreed to an impartial arbiter, and I was selected.
I read the examination question: "Show how it is possible to determine the height of a tall building with the aid of a barometer." The student had answered: "Take the barometer to the top of the building, attach a long rope to it, lower it to the street, and then bring it up, measuring the length of the rope. The length of the rope is the height of the building."
The student really had a strong case for full credit since he had really answered the question completely and correctly! On the other hand, if full credit were given, it could well contribute to a high grade in his physics course and certify competence in physics, but the answer did not confirm this.
I suggested that the student have another try. I gave the student six minutes to answer the question with the warning that the answer should show some knowledge of physics. At the end of five minutes, he hadn't written anything. I asked if he wished to give up, but he said he had many answers to this problem; he was just thinking of the best one. I excused myself for interrupting him and asked him to please go on.
In the next minute, he dashed off his answer, which read: "Take the barometer to the top of the building and lean over the edge of the roof. Drop the barometer, timing its fall with a stopwatch. Then, using the formula x=0.5*a*t^2, calculate the height of the building." At this point, I asked my colleague if he would give up. He conceded, and gave the student almost full credit.
While leaving my colleague's office, I recalled that the student had said that he had other answers to the problem, so I asked him what they were.
"Well," said the student, "there are many ways of getting the height of a tall building with the aid of a barometer.
For example, you could take the barometer out on a sunny day and measure the height of the barometer, the length of its shadow, and the length of the shadow of the building, and by the use of simple proportion, determine the height of the building."
"Fine," I said, "and others?"
"Yes," said the student, "there is a very basic measurement method you will like. In this method, you take the barometer and begin to walk up the stairs. As you climb the stairs, you mark off the length of the barometer along the wall. You then count the number of marks, and this will give you the height of the building in barometer units." "A very direct method."
"Of course. If you want a more sophisticated method, you can tie the barometer to the end of a string, swing it as a pendulum, and determine the value of g [gravity] at the street level and at the top of the building. From the difference between the two values of g, the height of the building, in principle, can be calculated."
"On this same tack, you could take the barometer to the top of the building, attach a long rope to it, lower it to just above the street, and then swing it as a pendulum. You could then calculate the height of the building by the period of the precession".
"Finally," he concluded, "there are many other ways of solving the problem. Probably the best," he said, "is to take the barometer to the basement and knock on the superintendent's door. When the superintendent answers, you speak to him as follows: 'Mr. Superintendent, here is a fine barometer. If you will tell me the height of the building, I will give you this barometer."
At this point, I asked the student if he really did not know the conventional answer to this question. He admitted that he did, but said that he was fed up with high school and college instructors trying to teach him how to think.
The name of the studen
The best part of that story:
...all of the methods attributed to Bohr are more accurate than the method the professor considered to be the 'right' solution.
(delta P on the barometer will be so small that error in reading the difference will dominate the result)
> NT has roots in VMS.
Someone once told me to increment each letter in VMS to get WNT. Kind of like the IBM --> HAL.
Het told you to find 10 vulnarebilties. Then find them. They don't have to be all true buffer overrun errors. How about finding a security vulnarebelity in a "wrong setup" environment. Avoid best practice and run php under root. and so on. Bet you can list your 8 missing vuln's in an hour.
How about "file system becomes damaged if power is unplugged" (DOS atttack when running without UPS).