Slashdot Mirror
Homeland Security Uncovers Critical Flaw in X11
Amy's Robot writes "An open-source security audit program funded by the U.S. Department of
Homeland Security has flagged a critical vulnerability in the X Window System (X11) which is used in Unix and Linux systems. A missing parentheses in a bit of code is to blame. The error can grant a user root access, and was discovered using an automated code-scanning tool." While serious, the flaw has already been corrected.
In related news, the Department of Homeland security has notifed 3497 people where their missing TV remote control is to be found, where your wife was until 3am last Thursday and have completed a record number of soduku puzzles in newspapers around the country.
Government officials were unwilling to cite their sources for this information instead choosing to simply say "we are watching you".
liqbase
Kudos to the heroes who painstakingly reinserted the missing parenthesis!
You see? You see? Your stupid minds! Stupid! Stupid!
A missing parentheses in a bit of code is to blame...the flaw has already been corrected.
Any word on exactly what the fix was?
Wanted: witty unique signature. Must be willing to relocate.
Shouldn't that be:
(X11 sucks monkey cock
Finally Homeland security has done something noteworthy. I'm glad this benefits the X11 community.
the answers you get depend on the questions you ask.
I wonder if Miles Papazian discovered the flaw by reading the binary or by utilizing a machine-coded matrix?
Only one that they are telling us about...
If you want news from today, you have to come back tomorrow.
X11 is actually written entirely in LISP, and therefore there are too many parentheses for a mere mortal to ever get straight.
XML is like violence. If it doesn't solve the problem, use more.
If the compiler doesn't have a problem with unmatched parentheses, to prevent any such problems in the future, simply insert) closing) parentheses) instead) of) spaces).
Maybe it's an X11 server.
Actually, it was not a missing parenthesis, but a missing parenthetical.
double r;r = ( (double)rand() / ((double)(RAND_MAX)+(double)(1)) );
if ( r < 0.5 ) gotroot(true);
And the patched code:
double r;r = ( (double)rand() / ((double)(RAND_MAX)+(double)(1)) );
if ( r < 0.5 ) gotroot(true); (just kidding!)
Well, from TFA: "This was caused by something as seemingly harmless as a missing closing parenthesis"
So no, it is indeed just a closing paranthesis that is missing. Why exactly that bloke considered this 'seemingly harmless', I don't know though... that is rather like saying "The car crash was caused by something as seemingly harmless as a severed brakeline."
..I just saw a story on digg (washes mouth out with pee to get bad taste out of my mouth), and noticed that the FAA just announced they will be running linux to track flights. Maybe there is a tie in-between this find and that announcement?
Sig: I stole this sig.
That is one brilliant policy! Kudos to whomever implemented that!
It reminds of an incedent about 12 years ago. A bunch of us entry level programmers were sitting around and this one guy pipes up and says "Look! I wrote an entire function (it was C) in one line!" He did, too. It was one of those 'for' loops with a 'while' and a bunch of things in one line. It was impossible to read. I just shook my head and said, "If there's a bug in that code, and I get assigned to it, I'm coming for you!"
is getting close to being able to do what they portray on 24.
Jack: I'm running out of time. I need that salelite image.
Chloe: I opened a socket into a NASA server and retasking the satelite.
Jack: Great, download the image to my PDA.
Chloe: I need your IP address.
Jack: 1.2.123.129
Chloe: I'm having some trouble. I'm hacking into a secure server at CTU, and sending the image to your PDA.
Jack: I've got it. Thanks Chloe.
Chloe: Whatever...
More specifically, March 10th of 2006. Seven weeks ago.
Best part was the CVS log:
Depends,
Have you paid your Moses Fee?
(let my packets go....) [as sung to 'let my people go']
Less Talk. More Stab.
"Whereas Europeans generally pronounce my name the right way ('Ni-klows Wirt'), Americans invariably mangle it into 'Nick-les Worth'. This is to say that Europeans call me by name, but Americans call me by value."
http://en.wikipedia.org/wiki/Niklaus_Wirth
So was the X11 bug in European or American code?
Yes.
Dewey, what part of this looks like authorities should be involved?
Microsoft runs these bug-checker-programs on their code all the time.
Excluding Outlook Express I guess.
"Excluding Outlook Express I guess."
Perhaps it's part of their market effort to get people to uprade to Outlook.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Yeah, but Windows is still safer, because the useful bugs are hidden in with all these other bugs. In fact, it's sometimes hard for a hacker to get to the exploit, because, first he runs into what I like to call "the blue screen OF FREEDOM!"
Starring Bruce Willis, of course, who assembles a crack team to go into the code and insert the missing punctuation before the world gets blown up.
Then if I want to do my own debugging, I should only put half my effort into coding!