DJB Announces 44 Security Holes In *nix Software

generationxyu writes "D. J. Bernstein, better known as DJB, has announced the discovery of 44 security holes that were found by students in his course MCS 494: Unix Security Holes this fall at the University of Illinois at Chicago. Vulnerable programs of note include: CUPS, NASM, mpg123, MPlayer, xine-lib, and numerous others. Copies of the notification emails are here. The homework for the course was to find and exploit 10 previously undiscovered security holes in currently deployed Unix software. In a class of 25, 44 security holes seems a bit low. Most of the class failed. I was credited with bsb2ppm (actually libbsb) and jpegtoavi. After 300 hours of work and an A average on the exams, I expect to fail the course."

Comments

Misleading Title

[__aaitqo8496]

The title of this article is quite confusing, if I read it correctly. To me, it reads that *nix variants themselves have 44 security holes (as in something in the underlying OS, such as the kernel). However, upon further reading the story indicates that it is actually the 3rd party software that has holes in it. Sounds a little unfair to *nix environments. Consider blaming Microsoft for all holes in ever Win32 program (oh wait, we already do!) How about a better title like "DJB Announces 44 Security Holes In *nix-based Software"

Re:Misleading Title

[WIAKywbfatw]

If you want to get technical you could argue that everything apart from the kernel is *nix-based software. Where do you want to draw the line?

Re:Misleading Title

[Dekke]

Because if it weren't sensationalist, who would ever read it? For the knowledge? Hah! For shame, thinking we want accuracy...

Re:Misleading Title

[__aaitqo8496]

For the sake of argument, what would you consider Windows software? The kernel, the graphics server, the programs that come with every "distribution" of Windows?

I think that most people would agree that if the program can be *easily* removed from the underlying OS, it's not part of the OS itself. Therefore I would not consider notepad.exe part of the OS, however I would consider explorer.exe (even though it is a seperate application).

If you don't agree, it's okay, but that's how I think of it.

Re:Misleading Title

[Cuthalion]

Have you actually tried removing notepad?

Windows tries pretty hard to keep you from doing so.

Re:Misleading Title

[FatAlb3rt]

so...why didn't someone just write some intentionally crappy software, stick it on sourceforge, then point out the flaws?

or better yet, since it sounds as if this is an assignment due at the end of the semester, dive into some code, write up a few paragraphs on what you *think* is a security flaw, and submit it.

heck, i think the instructor should give credit for explaining 10 good code examples of secure routines.

Re:Misleading Title

[Crazy Eight]

NT has roots in VMS. The BSD advertising clause you're seeing comes from one piece of BSD software (I can't recall which) Microsoft incorporated.

Re:Misleading Title

[SquadBoy]

RTFA in all the emails he gives full credit to the students.

James Longstreet and Tom Indelli, two students in my Fall 2004 UNIX
Security Holes course, have discovered a remotely exploitable security
hole in bsb2ppm, a program to convert BSB image files to PPM image
files. I'm publishing this notice, but all the discovery credits should
be assigned to Longstreet and Indelli.

Re:Misleading Title

[stor]

For the sake of argument, what would you consider Windows software? The kernel, the graphics server, the programs that come with every "distribution" of Windows?

Ahh, this is such stuff that pointless flamewars are made on.

Cheers
Stor

Re:Misleading Title

[new-black-hand]

The BSD advertising clause you're seeing comes from one piece of BSD software (I can't recall which) Microsoft incorporated.

BSD Sockets (Winsock on Win32). Ever noticed that socket programming on UNIX and Win32 are extremely similar? Not a co-incidence.

Re:Misleading Title

[SnowZero]

NT was originally developed by many of the core VMS developers after they left DEC, thus its VMS-like flavor. It doesn't use any code from VMS, but was a chance for the developers to start over and build a next generation operating system. They also tried to work with IBM in doing so (whee culture clash). My only gripe is that they took that clean, portable system, and put the Win32 API on top of it.

Wikipedia has a nice entry that is consistent with everything I learned there as an intern a while back. After I left there were many rumors that NT took BSD's better performing TCP stack, but unless someone who knows ever tells the story, its still just a rumor. What is true though it that they use some acient utilities ported from BSD, such as the command-line ftp.

Re:Misleading Title

[Chris Burke]

Ahh, this is such stuff that pointless flamewars are made on.

No it isn't, you moron!

Re:Misleading Title

[innosent]

This is more likely due to the fact that the BSD TCP/IP stack is essentially the reference implementation of TCP/IP. Which is odd, considering that the BSD stack is missing a fairly major feature of the TCP/IP standard (equal-cost multipath routing, which Linux does support, though Windows does not). At any rate, there are probably portions of the TCP/IP process that are under a BSD copyright, and Windows uses some of the same procedures (though probably not code) to implement their stack. As for the similar API, that probably has more to do with POSIX than MS copying code. I would imagine that the internals of Windows and *BSD are different enough that it would be easier to rewrite the socket API than to copy it and change it for Windows.

Re:Misleading Title

[hazem]

> NT has roots in VMS.

Someone once told me to increment each letter in VMS to get WNT. Kind of like the IBM --> HAL.

Re:Misleading Title

[fish_in_the_c]

Microsofts documentation on sockets is very misleading. If you want to find out how misleading create an array of sockets each open on a different port. Pass the array to another thread within your program and then try to read something from one of the sockets. It won't work because of the way that windows handles messaging and the fact that socket objects have a message queue an therefore cannot be passed between threads. I know from painful expierence.

Don't just take this lying down, IMO

[Skyshadow]

Now that's a tough assignment. 44 holes found is an average of less than two a person -- it's possible the *entire* class failed, not just most. At best, probably one person completed the assignment.

As much as I respect profs who are willing to push you to do neat things (finding 44 holes in UNIX and it's standard set of programs is nothing to sneeze at), if you really do fail the class I'd take this straight to the administration. They're letting you down by allowing a professor to fail an entire class, especially since the grades are based on something that doesn't really reflect your understanding of the subject.

I've always had a problem with this sort of behavior in college profs -- it gets away from what I consider to be the basic nature of higher education. As a student, I'm the consumer. I'm paying the professor to teach me what he/she knows and then to rate how well I've absorbed that information at the end of the class. Assignments such as this one or classes which are set up as "cut down classes" just aren't consistant with that.

It works the same way on the other end; I had a few professors in college who would cancel class on a fairly routine basis. Hey, I enjoy the odd day off as much as anyone else, but I'm paying a lot of money based on the assumption that I'm going to be getting something in return -- if I were to subscribe to a magazine and then only get 2/3rds of the issues, do you thing I'd be within my rights to object? Hell, the overly easy classes were bad enough; I actually had a few that graded based mostly on attendance. Yeah, getting the most for my tuition dollar there.

Anyhow, I know there are folks out there who are going to disagree with my view of a University education, and that's fine, but regardless I would really encourage you not to accept this lying down. I know as a student it often seems like you're powerless, but if 25 of you (and your parents -- I know you're an adult, but schools listen to parents) get together and make yourselves heard, you'll probably end up with a satisfactory outcome.

Re:Don't just take this lying down, IMO

[jdray]

I wouldn't get too worked up about it until it happens. I had several college profs who started out the terms saying how they were strict about assignments getting turned in, and how you could fail if you didn't do this or that; I rarely found their bite to be as bad as their bark. Mostly they want to put the fear of them as a deity figure in you, then be gracious later. If they get overwhelmed, they've set a good baseline to fall back on.

Re:Don't just take this lying down, IMO

[Marxist Hacker 42]

Not disagreeing- but if I was this student, I'd get a few buddies together from the class and point out to the prof:
1. This is the first term this class has been taught.
2. Nobody did well with the homework if the entire class of 25 students only found 44 holes.
3. Even those who were among the best students in the class, getting A's on all the exams, only found 2-3 holes.

Therefore the grades should be assigned to fit a bell curve based mainly on test scores and minimizing points earned for the homework.

Re:Don't just take this lying down, IMO

[Saint Stephen]

My algorithms class was like this. I aced every test but didn't complete the Travelling Salesman program successfully. I got an "incomplete" and had to come to summer school. Boy was I mad at the time but I see now why they did it. All or nothing.

Re:Don't just take this lying down, IMO

[mateomiguel]

"As a student, I'm the consumer. "

No, no, and hell no. As a student, you are a student. Leave your stupid consumer victimization routine in suburbia, where it belongs. Don't try to bring that crap to academia.

Re:Don't just take this lying down, IMO

[bani]

you really think djb cares? given his well known history of being supreme asshole of the known universe?

fwiw this was obviously djb trying to get his students to dig up ammo for him to go on another one of his public penis-waving tantrums, acting all smug and high and mighty again (oh lookit me i wrote qmail and its all uber secure, and wooo lookit all the MISERABLE LAMERS WRITING SHIT CODE!!1!!111!)

Re:Don't just take this lying down, IMO

[KillerDeathRobot]

As soon as universities start being free, I'll agree with you.

Re:Don't just take this lying down, IMO

[Marxist Hacker 42]

Perhaps- I didn't think of this until reading your post- that's exactly what the professor was trying to teach. Though it would be a damned awfull way to do it, I've got to admit that 95% of the projects I've worked on since college have followed that general path. Work obscenely hard- get a product out there- get laid off when the marketing people spend tons on booze to cover their poor marketing skills and drive the company into the ground. Yep- sounds just like this assignment.

Re:Don't just take this lying down, IMO

[plopez]

It could be the prof was trying to weed out the riff-raff (those who think they are hot but are not, etc.). But giving such an open ended project at the undergrad level is extreme. It is appropriate for grad school, where research projects sometimes are not completed, but not undergrad (I assume by the number it is undergrad).

I actually had a class like that, expected to fail but passed becase I actually did a lot of work on the problem and it showed. This may be one of those cases. Remember, research is about trying your best but still failing, actually most of the time.

Re:Don't just take this lying down, IMO

[Skyshadow]

I don't have any problem with the concept of an entire class failing a course. Why you think that a professor failing his entire class constitutes a failure on the part of the university is a mystery to me: would you be so opposed if a professor failed an astronomy class that failed to put the planets in the correct order or an economics class that couldn't describe how supply and demand affect prices?

Frankly, I think you're jumping the gun here...

I didn't jump the gun, I provided a qualified statement. You know, "if he does this then you should do this".

Now, let me provide another statement which may or may not apply to this specific case (since we haven't seen grades yet): Any time an entire class fails, it is on the professor's shoulders. Since we assume that the people in the class are both mentally competent and reasonably intelligent based on the fact that they're in college, and excepting odd situations (a 1 or 2 person class, for instance), a near-100% failure rate can only be one of three things:

1. The professor has created a class which cannot be successfully completed given the time constraints and the level of the students.
2. The professor has completely failed to impart his knowledge to the students.
3. The professor has based the grades on items which do not accurately reflect what was taught in the class.

Implying that a professor who fails all or nearly all of a given class has competently done his/her job is nonsense. It's not "part of the learning experience", it's a professional failure on the part of the professor and needs to be treated as such. In any event, when this sort of extraordinary event occurs, the University itself is responsible for allowing that failure to occur.

Re:Don't just take this lying down, IMO

[Punk Walrus]

Why you think that a professor failing his entire class constitutes a failure on the part of the university is a mystery to me: would you be so opposed if a professor failed an astronomy class that failed to put the planets in the correct order or an economics class that couldn't describe how supply and demand affect prices?

That's different, and it's still bad because that reflects poorly on the professor. If you were a university, would you want to hire a professor of astronomy who couldn't teach people the basics (for whatever reason)?

What most of these posts are saying is that this professor did not grade these students on a reasonable test of their skills. It's kind of like a professor of Art History requiring students to discover a previously undiscovered Picasso. Sure, some may exist in people's basements or garage sales, and sometimes a new piece of art from an expired artist shows up on the auction block from an previously unknown collector of rare things, but would you consider it fair to flunk art students who could not find a new Picasso? How would you rate such a find, grade-wise?

Re:Don't just take this lying down, IMO

[Anonymous Coward]

Mostly they want to put the fear of them as a deity figure in you...

Wrong. Mostly they want to get the lazy and uninterested students to drop their course.

Re:Don't just take this lying down, IMO

[myowntrueself]

and my entire class was failed because noone could write a program to check whether another, arbitrary program, would eventually finish execution...

Re:Don't just take this lying down, IMO

[Gherald]

Not wanting to fail a class hardly qualifies as being "obsessed with grades."

Re:Don't just take this lying down, IMO

[jdray]

Right. Forgot that part.

1) Make wildly overstated demands.
2) Watch 1/3 of students abandon class.
3) Hold class
4) Back off on demands and grade fairly.

(Sorry, this is academia. No profit involved.)

Re:Don't just take this lying down, IMO

[edunbar93]

oh lookit me i wrote qmail and its all uber secure

That's cute. His code may not have any bugs in it, but damn, does it ever have some huge logical flaws.

Qmail has the lovely lack of ability to reject e-mail while the SMTP connection is still active. What it does instead is it creates and sends a bounce message itself, instead of leaving that up to the sending server. What happens when you do this is you allow spammers to send e-mail to recipients in the To: line instead of the From: line, just by putting in a bogus To: line and putting the real recipient in the From: line.

There's a patch for this, but it involves setting up a list of e-mail addresses that are allowed to be accepted. Once you have several thousand e-mail addresses all over the place courtesy of Vpopmail, this becomes an impossible task.

So no, this man isn't a perfect programmer.

Re:Don't just take this lying down, IMO

[Mornelithe]

What does your experience---failing two out of 64 people for incompetence, and having a class with an overall C average---have to do with what your post's parent was talking about---a class where 100% of the students receive an F?

Are you implying, for example, that all 25 students in a graduate course entitled 'Unix Security Holes' were either incompetent or didn't even make an effort at completing the course? Are you implying that in most cases where an entire class fails---with an F, not a C---that it is because every student either slacked off or was incompetent? I won't rule out that possibility, but I think it's very unlikely that in any given class, there isn't anyone who isn't both intelligent and hard-working enough to at least get a D in the class. Do you have reason to believe otherwise?

All you need is one more hole...

[Nom du Keyboard]

After 300 hours of work and an A average on the exams, I expect to fail the course.

All you need to do is find one more hole, this one in the campus records department, and exploit it for improving your grade. If you have an "A" average otherwise, another "A" will look right in place. It's the "D" average people suddenly getting "A"s and "B"s that draw suspicion.

and the moral is:

[pchan-]

After 300 hours of work and an A average on the exams, I expect to fail the course.

but we've all learned a valuable lesson: don't take a class taught by DJB

Better link

[generationxyu]

to Kris Kubicki's mirror is here.

Hmm...

[excaliber19]

Perhaps Microsoft should try this strategy. Im sure the kids would thoroughly enjoy that assignment! They'd have bugs coming out the wazoo! A's for everyone!

What?

[jjshoe]

What no djb tools on the list? That seems the quickest way to fail, find an exploit in a djb tool.

Re:What?

[thogard]

Been there, done that, reported it, fix still not in qmail (as far as I know). You don't get the reward if the bug is an interaction between qmail and the os. I don't run qmail because of that issue. I could care less if the core code is secure unless its interactions with its enviroment (what ever that may be) are also locked down.

And I agree with user 820979.

Where's the gumpf?

[caluml]

Hey! I've found remote roots in OpenSSH, Apache, and Bind. If you run the file below, you can get root.

[ Part 2, Text/PLAIN (charset: unknown-8bit) 95 lines. ]
[ Unable to print this part. ]

ah, buffer overflows...

[Mr. Slippery]

I see the two specific items linked to are buffer overflow exploits. Anyone learning to program in C needs to have good buffer dicipline beaten into their heads.

It's like wiping your butt after crapping - mandatory basic hygine. If you can always remember to wipe your butt, you can always remembers to watch your buffer lengths.

Re:ah, buffer overflows...

[symbolic]

If you can always remember to wipe your butt, you can always remembers to watch your buffer lengths.

Well, there's the problem!

But you have already found 10 bugs!!!

[jgbustos]

Why take for granted that the number of bugs to be found was expressed in base-10? Why not base-2?

Re:But you have already found 10 bugs!!!

[addaon]

base-10 is base-2. Or did you mean base-1010?

My thoughts.

[Anonymous Coward]

Thesis: This professor is retarded.

Evidence to support this belief:

1) Giving homework to "go out and find some exploits" doesn't teach you anything and has a very unpredictable "path to completion"; i.e., it's not like there's a "problem" to solve, per se. It's simply a matter of some students having gotten lucky whereas others failed.

2) "After 300 hours of work and an A average on the exams, I expect to fail the course." Either the student is overly-pessimistic (which is possible), or the prof has done very little to: (a) boost morale, reassure students, or instil confidence; or, (b) grade students appropriately for the effort that they've put in. I think that the truth always lies somewhere between the extremes ... which would lead me to believe "a little bit of both".

3) "In a class of 25, 44 security holes seems a bit low." I highly doubt this, but then again, it entirely depends. If you're trying to find a security hole in "telnet" or "finger", I think you'd be outta luck -- the average joe undergrad would be better off picking random numbers to win the lottery than to find holes in software that has been tried, tested, and true for years.

Alternatively, if you just go to http://freshmeat.net and find some little backward project coded by a grade 9 high school student -- well, yeah, I think that an exploit should be pretty straightforward. Which leads me to ask: What the fuck does this assignment actually prove/teach? (See point (1), above.)

Re:My thoughts.

[slavemowgli]

It teaches you that professors can be asshats/idiots/..., too, and that you should not take classes taught by DJB. Furthermore, it teaches you that in life, you will still get treated like shit even when you're paying for things (like your education, in this case), and that having a famous name (like DJB) is more important than what you actually do.

Re:It's just an assignment - Did you even go to un

[grazzy]

If you read the slides from the first lecture, it says the findings of holes amounts to 60% of your grade.

Fourth year: bird courses only please

[Ars-Fartsica]

Who signs up for hard classes in fourth year? Duh! You've practically got your degree. sit back, uncap a cold one and choose from the many many many easy courses every school offers to fourth year students.

Its well known that every college grinds out the poor students in the first two years...if you've made it to fourth year, its time to ladle up some gravy and bolster your GPA in time for grad school applications, resume bolstering, etc.

So the real moral is that the most intelligent students are the ones avoiding the course altogether. If you want to get an education in unix security holes, go read the OpenBSD mail archives.

What's the deal?

[retro128]

The homework for the course was to find and exploit 10 previously undiscovered security holes in currently deployed Unix software.

10 for each student? I doubt DJB himself could find 10 on his own inside of a semester.

In a class of 25, 44 security holes seems a bit low. Most of the class failed. I was credited with bsb2ppm (actually libbsb) and jpegtoavi. After 300 hours of work and an A average on the exams, I expect to fail the course.

I guess the whispers I've been hearing about DJB being a complete asshole are true. It is always nice to have your academic future dictated by such people to your disadvantage, even though you may be a cut above the teacher himself. And in the meantime he will take credit for your work while simultaneously failing you. Thank you, sir, for reminding me why I dropped out of college.

Students didn't exploit the loophole

[fireboy1919]

He pretty much gave them free reign. ANY OSS at all!

Have you seen CPAN? Half of that code is something someone hacked up in a day! And what about all those sourceforge projects that have one developer and less than 10000 lines?

Meanwhile, almost every piece of code that this class is looking at is stuff that's already had a once over - heck, probably even been looked over thousands of times. No wonder they couldn't find any bugs. They were looking in the houses, not the motels.

If the majority of the class failed...

[JoshMKiV]

If the majority of the class failed, then the professor failed YOU.

Clearing up ALL "it's just an assignment" posts:

[generationxyu]

60%. This assignment is worth 60% of the FINAL SEMESTER GRADE. I suppose I should have put that in the summary.

Agreed, many profs are abusive

[Ars-Fartsica]

From time to time you do get a normal human being lecturing you, but often you get an inhuman prick whose real mastery is in manipulating human emotions. I've watched a calculus prof reduce many female students to tears...and I'm thinking, what is it dude, a sexual thing? I mean, come on, show some dignity and respect for the students.

The problem is that many of the profs have no professional experience outside the academic realm. None. Amazing as it sounds, they go from graduate work to post-doc to the faculty lounge, all the while succesfully avoiding any opportunity to deal with people as equals...its always grovelling to someone or getting someone to grovel to you. Its no coincidence many sleep with their students, its often the only way they can get laid.

The dynamics of academic environments are truly absurd, I'm amazed more of them are not murdered.

Sounds like Fermi at University of Chicago

[monopole]

Enrico Fermi supposedly failed every single person who ever took his Quantum Mechanics course at the University of Chicago. A special footnote had to be added to transcripts as a result.

The pity is that such a strategy allows for no differentiation between people who are working at their full capacity and goof-offs who sleep though class.

Re:Sounds like Fermi at University of Chicago

[tootlemonde]

Enrico Fermi supposedly failed every single person who ever took his Quantum Mechanics course at the University of Chicago.

This story is not likely.

Fermi only gave the quantium mechanics course once in 1954 in the last year of his life. He was known as an outstanding teacher, always willing to help students. His notes for the course were published in a book titled Notes on Quantum Mechanics with additional material supplied by one of the students. None of the reviews I've found mention the story about all the students failing.

One of his colleagues writes:

Fermi's legendary classroom teaching was the fruit of careful preparation. He seemed to derive pleasure from the act of teaching, without regard for the result. He never showed annoyance at a student's failure to grasp on the first try (or even the second) what he was trying to explain. On the contrary, if Fermi had to repeat an explanation, his pleasure appeared to be doubled.

Re:Most people will pass

[wk633]

D.L. Parnas once taught a 300 level software engineering class at the University of Victoria.

Grading used the 'high tide' method. That is, better score in one area of the course (exam, project, assignments) could override a poor score in another area. All instructor's judgement.

One student I knew got a C+ and discovered that he had roughly the same scores in each area as another student who got an A. That is, guy I knew had a poor exam, but awesome project. Someone else had nearly identical exam scores, and nearly the same (A) project.

So guy-I-knew approached Parnas, and asked why.

"Becuase I don't like you".

And that was the end of it.

Mplayer and Xine new security releases

[andymar]

"Multiple vulnerabilities were discovered in MPlayer by iDEFENSE, and more were found by us while reviewing the code"
http://www.mplayerhq.hu/

"New xine-lib released. This version adress multiple security vulnerabilites on PNM and Real RTSP clients. All users are advised to upgrade to 1-rc8. The release also includes several bug fixes and new features"
http://xinehq.de/

Re:Mplayer and Xine new security releases

[iive]

Place mod the parent up.

As one of the mplayer developers, I would like to thank to DJB for giving us (hmm)16 (?) hours before unleashing exploints on wild.

Maybe he is not aware that making right fix, testing it and finally releasing it, is not so simple task. Especially if we have to convice the person that have release (write) permisions, that him girlfriend is not as importan as the security release:)

Not to say, that I still haven't got the mail in my mailbox, despire that gmame shows it have been recived.

Also mplayer-dev-eng@mplayerhq.hu is the more appropriate maillist to send security issues. (MPlayer documentation will be updated accordingly.)

The exploit that is found in MPlayer is not alone. There are at least 2 other places with similar exploitable bahavioud in the same file. I guess the students keep them for next semester.

BTW code originates from Xine, probably it is time to update our version ;)

10 types of people ...

[fuufump]

The homework for the course was to find and exploit 10 previously undiscovered security holes in currently deployed Unix software.

"There are only 10 types of people in the world: Those who understand binary, and those who don't"

Fuzz testing

[ScottMaxwell]

If you want a quick and easy way to find potentially exploitable bugs, try fuzz testing. This is as simple as it could be: feed random data (e.g., from /dev/random) into applications until you crash one. That usually means there's a buffer overflow, which you can then exploit. Re-run the test under a debugger to pinpoint the exact cause of the crash, then craft an attack.

The better approach is to create one or more large files of random data and feed that into the apps; this is better because it gives you a reproducible stream. (Or you can use a Perl script with a known srand() seed.)

The term "fuzz testing" comes from a seminal 1990 paper (and followups in 1995 and 2000) by Barton Miller et al., who, incidentally, found much higher quality in GNU tools than in their proprietary counterparts. Before my tendinitis got too bad, I used to run The Bulletproof Penguin a one-man project devoted to stamping out such bugs (my initial goal, easily achieved, was to eliminate all the bugs reported in the original paper). Ben Woodard was doing something very similar for a while, but I don't know whether he still does.

Incidentally, this makes a certain recent Slashdot story more embarrassing: it seems that free Web browsers crash on malformed input, the kind of case that free software normally handles better than its proprietary competition.

Re:It's just an assignment - Did you even go to un

[prockcore]

If you read the slides from the first lecture, it says the findings of holes amounts to 60% of your grade.

Makes sense.

The requirements are to exploit 10 holes in unix software. Nowhere does it say that the unix software must come standard with any distros, and it doesn't say that you can't write it yourself.

Write a simple program with 10 holes in it, point them out, and boom you win.

We are talking about finding vulnerabilities and exploiting them aren't we? I'd get extra credit for finding and exploiting holes the class requirements.

Crash....

[oliverthered]

I've reported 4 stack/pointer based crashes in Konqueror in the past couple of days and they just came to me without looking.

If I could have crafted an exploit for the crashes then that would be 4 holes.

All the students needed to do was look at the current/recent bugs list for a version of software.

Identify bugs that could possibly be exploited. (say maybe 100)
Run automated buffer/stack exploit
checking software against those bugs.

hope to get 10 criticals.

Khtml's probably a good choice for exploiting at the moment, as it's getting a lot of 'features and fixes' which probably caused the crashed I've reported.

Re:Modern education sunken to a new low

[jrockway]

Were you in the class?

The exams and the homework were completely different. DJB should post the exams; there's lots of theoretical holes that we had to find for exams. It was very comprehensive, educational, and practical. It was a great course. (I too failed it, but grades and learning are not necessarily related. For the record I only missed points on exams because my exploit code wasn't C99-compliant :)

Re:It's just an assignment - Did you even go to un

[SetupWeasel]

That kind of stuff usually doesn't work. In an Astronomy class (toward an Astronomy major, not that gen-ed crap) the professor did not tell us we would have to remember constants, and he asked them as questions. They were short questions, and weren't worth a lot.

One of them was: What is the orbital period of Saturn? (2 pts/100)

I started thinking about Bode's law and the posibility I could calculate it from an approximate radius I would get from that law... if I could remember it. But when you expect a 72% to be an A on a test, you have bigger fish to fry.

Then I got it. It was right, it should work, and no one would have to be nailed to anything.

I wrote: One Saturn-Year

I didn't get credit for it. A couple years later a sophmore was telling me about this funny question he had in the same class. He showed it to me. It read:

What is the orbital period of Saturn? (Do not put one Saturn-Year)

I was so right that it had to be guarded against. Yet those were 2 points I would never have.

Re:Most people will pass

[winwar]

"So guy-I-knew approached Parnas, and asked why.

"Becuase I don't like you".

And that was the end of it."

I wonder why? Disliking someone is NOT a valid reason to assign low grades. Thinking their work is crap is a valid reason. That statement pretty much could have enabled the student to have his grade reevaluated by an outside observer. I would have complained to academic affairs. After all, if the professor already dislikes you, that bridge is already burned.

If the story is true, of course.

Re:Modern education sunken to a new low

[be-fan]

I think the point of contention is that people are saying that grades and learning *should* be related. Grades should reflect what you know --- they are utterly useless otherwise.

Re:Good idea?

[jrockway]

We all already failed the course :-)

We're not blaming DJB for our failure. He told us we would fail if we didn't find 10 unique holes. We didn't find 10 holes, so we failed. It's not hard to understand. DJB is not the guy that goes back on his word. He tells you what he means and sticks with it. That's something to respect. (Same with all the DJB-isms. Nothing wrong with saying what you mean and being confident in those statements.)

We're upset about failing, but that's life. It's the hardest CS course at the University (and this is my first semester in college), so it's expected. I know more about C, computer internals, and security than most professionals now, so I'm not too sad :)

Varying levels of seriousness...

[Goonie]

Some of these exploits are "real" security holes, in that they are exploitable by things users might actually do - playing a media file, or printing something.

Others are pretty implausible, for instance the jpegtoavi exploit, which requires the user to run the jpegtoavi program on a set of files provided by an attacker.

On my quick perusal, the nastiest holes seem to be the changepassword hole, a local root exploit, and the two holes in cups, particularly the first one, which straightforwardly gets the attacker access to user "lp" where they can monitor everything that gets printed.

One thing that is a bit surprising and disappointing is that so many of these bugs are from well-known bad coding practices. Why the hell is *anyone* still using strcat in distributed software, for instance?

Re:Varying levels of seriousness...

[jonadab]

> Blanket statements like this (and like "Goto is evil") do nothing to help
> improve the quality of software as we know it. strcat() is not evil. Using
> strcat on uncontrolled/unmonitored input on buffers whose memory allocation
> we are unsure of IS.

No. The problem here (either way) is not what *functions* the programmer is
using; the problem is what *language* the programmer is using. C was great
in the 1970s, when computers filled whole rooms and needed every instruction
per second that could be squeezed out of them. At the time, more robust
languages (such as lisp) were just too darned slow, and if a feature required
the computer to do a little too much (or waste too much storage), it just
wasn't implemented. Word wrap was an optional _extra_ in word processing
software, because it required the whole line to be (gasp) recopied while the
user waited! C was great because it allowed programs that would otherwise
have to be written in assembly language for efficiency reasons to be more
portable -- and Unix directly benefitted from this, outstripping and leaving
in the dust a number of otherwise better systems (TOPS-20 for example) that
were unfortunately tied to specific hardware. Languages that allocated string
space dynamically and did other things to coddle the programmer, such as
lisp or BASIC, were only good for specific tasks where performance was less
critical. The real VHLLs didn't even exist.

Today, there are still things that need to be written in a low-level language
such as C. Device drivers are an excellent example. The performance and the
efficiency really matter there. The kernel's scheduler is another example.
But these things should be written by experienced programmers who know the
heck what they're doing. (Yeah, I know, it doesn't always work out that way,
and even experienced programmers still make mistakes...) But we still have
every noob and his kid brother trying to write high-level applications in C
for no good reason, and *this* is why we still have buffer overruns -- it's
because we still have fixed-size buffers.

Will better languages eliminate all bugs? No. But they will, eventually,
as they are gradually adopted, eliminate certain whole *classes* of bugs
that have been plagueing us for 30+ years, buffer overruns being one of the
most obvious. Pointer errors are another thing you don't have in VHLLs,
because you don't have unsafe pointers or pointer arithmetic. (You can still
make the mistake of treating a return value that may be undef as if it's
definitely a reference, but the bug that results is easier to track down,
because instead of happily writing bits into an unrelated piece of storage
and possibly smashing something that will haunt you six hundred lines of
code later it immediately complains that you can't use that value as a
reference.) You don't get a fencepost error on the max value of an array
index when you've replaced your legacy C-style for loops with foreach loops
that don't use indices, for example. (Legacy for loops have been deprecated
in Perl for virtually ever now, and in Perl6 they are going away completely;
for will always mean foreach and will always operate on a list. The other
VHLLs that haven't done this already will eventually.)

Your correct, cheaper code is still horribly needlessly long for what it
accomplishes: with the brace style fixed for terseness and the superfluous
blank lines removed, it still comes to seven lines (lines!), just to
concatenate a couple of strings, which shouldn't take seven characters.
And yes, I know it's a contrived example, but it's still illustrative.

Re:It's just an assignment - Did you even go to un

[dcollins]

The requirements are to exploit 10 holes in unix software...

Not quite. From the first slide here's the credit specification (emphasis mine):

What you have to do
Exams are 40% of your grade.
Also three types of homework.
1. Read assigned parts of textbook. Assignment due 2004.08.25: foreword and preface of textbook.
2. Read assigned C program excerpts before we discuss them in class.
3. 60% of your grade: discover 10 new security holes in deployed UNIX software.
40 students = 400 new holes.
Collaboration is encouraged.
4 students who find 1 bug each receive 1/4 credit for it.

Presumably a toy program you write on your doesn't count as "deployed UNIX software".

Re:Misleading "Exploits" (Was Re:Misleading Title)

[Anonymous Coward]

No. You're wrong.

A video player, say, should be completely immune to bad input. It should not be possible to craft an input file that causes my vide player to delete files or anything like that.

There is a very limited class of data (scripts, executables) that need to be "dangerous". Viewing a jpeg, even a jpeg hand-crafted by Dr. Evil, should never have the ability to do anything bad [well, OK, seeing the goatse guy is abd, but you know what I mean].

Re:It's just an assignment - Did you even go to un

[Marxist Hacker 42]

Mine was modifying a string constant in Borland's Turbo C by setting a pointer variable to the begining of where the constant was stored and then changing the proper offset. When I got my test back, it said "-5, +5, I tried it it worked!". I was too much of a stupid kid to realize that you shouldn't write self modifying code in the global constants table.....

Re:Good idea?

[idontgno]

I know more about C, computer internals, and security than most professionals now, so I'm not too sad :)

You also know more about IT management, unrealistic goals, undeserved punishment, and PHBs than most professionals now. I don't know whether to rejoice in your hardwon jumpstart on corporate wisdom or mourn the inevitable early onset of cynicism.

Re:Good idea?

[squidfood]

We all already failed the course :-)

Of course you failed. Obviously, half of you were supposed to rapidly deploy buggy software via sourceforge while the other half "fixed" the problems. Or don't you know more about Dilbert than us professionals? :)

True, however...

[dpilot]

>1. Prof says 'I'll fail you if you don't perform a near-impossible test.'
>2. Student says 'OK.'

Nope.

Student weighs factors, realizes that if he takes the test, he'll probably fail the course. FAILING THE COURSE MEANS NO CREDIT HOURS, AND LOSS OF THAT TIME TO TAKE A DIFFERENT COURSE. Therefore, with regret, he takes his second choice for that slot.

Yes, Mr. Recruiter. I got an F in a course in my chosen major, but it was in an *impossible* course. Actually, between the presence of that F in the major field, and what it did to his GPA, he probably won't even get to see the recruiters he most wanted to see. He would have been weeded out before then.

The learning is great, sure. The impossible grade is serving absolutely nobody and nothing except DJB's ego.

Re:It's just an assignment - Did you even go to un

[rawb]

Sir Ernest Rutherford, President of the Royal Academy, and recipient of the Nobel Prize in Physics, related the following story.

Some time ago I received a call from a colleague. He was about to give a student a zero for his answer to a physics question, while the student claimed a perfect score. The instructor and the student agreed to an impartial arbiter, and I was selected.

I read the examination question: "Show how it is possible to determine the height of a tall building with the aid of a barometer." The student had answered: "Take the barometer to the top of the building, attach a long rope to it, lower it to the street, and then bring it up, measuring the length of the rope. The length of the rope is the height of the building."

The student really had a strong case for full credit since he had really answered the question completely and correctly! On the other hand, if full credit were given, it could well contribute to a high grade in his physics course and certify competence in physics, but the answer did not confirm this.

I suggested that the student have another try. I gave the student six minutes to answer the question with the warning that the answer should show some knowledge of physics. At the end of five minutes, he hadn't written anything. I asked if he wished to give up, but he said he had many answers to this problem; he was just thinking of the best one. I excused myself for interrupting him and asked him to please go on.

In the next minute, he dashed off his answer, which read: "Take the barometer to the top of the building and lean over the edge of the roof. Drop the barometer, timing its fall with a stopwatch. Then, using the formula x=0.5*a*t^2, calculate the height of the building." At this point, I asked my colleague if he would give up. He conceded, and gave the student almost full credit.

While leaving my colleague's office, I recalled that the student had said that he had other answers to the problem, so I asked him what they were.

"Well," said the student, "there are many ways of getting the height of a tall building with the aid of a barometer.

For example, you could take the barometer out on a sunny day and measure the height of the barometer, the length of its shadow, and the length of the shadow of the building, and by the use of simple proportion, determine the height of the building."

"Fine," I said, "and others?"

"Yes," said the student, "there is a very basic measurement method you will like. In this method, you take the barometer and begin to walk up the stairs. As you climb the stairs, you mark off the length of the barometer along the wall. You then count the number of marks, and this will give you the height of the building in barometer units." "A very direct method."

"Of course. If you want a more sophisticated method, you can tie the barometer to the end of a string, swing it as a pendulum, and determine the value of g [gravity] at the street level and at the top of the building. From the difference between the two values of g, the height of the building, in principle, can be calculated."

"On this same tack, you could take the barometer to the top of the building, attach a long rope to it, lower it to just above the street, and then swing it as a pendulum. You could then calculate the height of the building by the period of the precession".

"Finally," he concluded, "there are many other ways of solving the problem. Probably the best," he said, "is to take the barometer to the basement and knock on the superintendent's door. When the superintendent answers, you speak to him as follows: 'Mr. Superintendent, here is a fine barometer. If you will tell me the height of the building, I will give you this barometer."

At this point, I asked the student if he really did not know the conventional answer to this question. He admitted that he did, but said that he was fed up with high school and college instructors trying to teach him how to think.

The name of the studen

Re:It's just an assignment - Did you even go to un

[entropy_uc]

The best part of that story:

...all of the methods attributed to Bohr are more accurate than the method the professor considered to be the 'right' solution.

(delta P on the barometer will be so small that error in reading the difference will dominate the result)

Re:Good idea?

[geekoid]

you given an undoiable assignment, thats the problem.
Welcome to astronomy 101, 60% of your grade will depend on finding 10 new planets in our solar system

"and security than most professionals now,"

I have my doubts.

Urban legend

[bharlan]

When an anecdote is a little too perfect (and this one is way over the top), then you need to google for it at site:snopes.com. http://www.snopes.com/college/exam/barometer.asp

pollics.

[leuk_he]

Het told you to find 10 vulnarebilties. Then find them. They don't have to be all true buffer overrun errors. How about finding a security vulnarebelity in a "wrong setup" environment. Avoid best practice and run php under root. and so on. Bet you can list your 8 missing vuln's in an hour.

How about "file system becomes damaged if power is unplugged" (DOS atttack when running without UPS).

Re:Good idea?

[Civil_Disobedient]

We're not blaming DJB for our failure.

Well, then perhaps you do deserve to fail. He's the one doing the grading, and he's the person responsible for giving you an assignment where success is based as much on luck as on technical prowess.

He tells you what he means and sticks with it. That's something to respect.

This is called begging the question. Why, exactly, is this something to respect?

"Hey, I'm going to kill you if you don't give me your money."

"Well, I don't have any money."

"Sorry, gotta kill you."

"That's cool. I totally respect that."

Perhaps if you didn't idolize him as much, you might realize the practical consequences of a failing grade for your GPA, and potential employment future. But at least you got to learn from a kick-ass prof, right? Or rather, an ass-kicking prof.