Slashdot Mirror
Not Just Apple: GnuTLS Bug Means Security Flaw For Major Linux Distros
According to an article at Ars Technica, a major security bug faces Linux users, akin to the one recently found in Apple's iOS (and which Apple has since fixed). Says the article:"The bug is the result of commands in a section of the GnuTLS code that verify the authenticity of TLS certificates, which are often known simply as X509 certificates. The coding error, which may have been present in the code since 2005, causes critical verification checks to be terminated, drawing ironic parallels to the extremely critical 'goto fail' flaw that for months put users of Apple's iOS and OS X operating systems at risk of surreptitious eavesdropping attacks. Apple developers have since patched the bug." And while Apple can readily fix a bug in its own software, at least for users who keep up on patches, "Linux" refers to a broad range of systems and vendors, rather than a single company, and the affected systems include some of the biggest names in the Linux world, like Red Hat, Debian, and Ubuntu.
This if nothing else, should show everyone it's time to switch to Windows, the OS immune to exploits.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
The impact of this bug does not compare to the goto fail bug. Most Linux distributions use OpenSSL for TLS. Even if a program links to GnuTLS, it may not use GnuTLS for certificate validation, and if it doesn't, then it's not affected by this bug (one example is Google Chrome). It's not like iOS where everything is required (by App Store rules) to use SecureTransport.
My distro patched this over a month ago.
Il n'y a pas de Planet B.
that Apple took notice of some accusations that the NSA managed to modiy some open source codebases, reviewed all code that was checked in at about the suspicious time frame, and found the "goto fail" bug that way. No idea whether this is true, but I'd be curious who checked in this bug.
Is anyone other than Debian zealous enough to use GnuTLS?
I rarely agree with Howard Chu of OpenLDAP fame, but... http://www.openldap.org/lists/...
> Most Linux distributions use OpenSSL for TLS.
> Even if a program links to GnuTLS, it may not use GnuTLS for certificate validation,
> and if it doesn't, then it's not affected by this bug (one example is Google Chrome)
Agree. I've ran through everything that linked to gnutls on my distro (Arch) and although there's
quite a lot of binaries that do, most of those do not offer TLS connections (or any network connectivity at all), so my
guess (without knowing GNuTLS at all) is that they use some other feature offered by the library.
Of those that I know actually capable of SSL/TLS connections, all (also) link to OpenSSL.
So without making a definitive statement, AFAICT this should have near zero impact on GNU/Linux.
Are you trolling for an Apple-vs-Linux flame war? do you have a zealous attachment to Apple? or are you just dull?
1) This is old news, and the /. has already reported on it;
2) Hardly anything uses the GNU TLS library, and for the same reason people have been advising against Apple's rewrite of security libraries: because it's better to use something that's had over a decade of development and review and is widely deployed across a series of platforms;
3) You're arguing about the heterogeneity of the Linux platform as if it's a bad thing, while in fact this acts in Linux's favour. Even though the GNU project might like people to use gnutls, distros have chosen not to. Apple either discourages choice or makes it impossible, depending on what exactly you're targeting, which is why everything was affected.
Fixed at the beginning of March.
Example: http://advisories.mageia.org/MGASA-2014-0117.html
"Nothing to see here. Move on."
Create a library with that name that does nothing, or logs errors for any entry points. Why is something being shipped that is insecure. I understand that the builds have to be changed. But the library could be replaced with a skeleton right now, can't it?
And maybe we would see that its not quite as in-active as people think.
There are two distinct part of SSL/TLS; encryption and authentication. In this case it's only the authentication portion that has an issue, not the encryption portion. There are several places in which GnuTLS is used for encryption but not authentication such as MTA (email) transfers over TLS (at least most of the time).
As for why GnuTLS exists, AFAIK it's mainly because of licensing issues -- compiling a GPLv2+ program against OpenSSL gets into licensing troubles, so there needed to be a GPL compatible alternative.
In my ports tree:
audio/ario
audio/pianobar
deskutils/fusenshi
deskutils/taskd
deskutils/taskwarrior
devel/gwenhywfar
devel/gwenhywfar-fox16
devel/gwenhywfar-gtk2
devel/gwenhywfar-qt4
devel/librelp
devel/libvirt
editors/abiword
editors/emacs
editors/emacs-nox11
emulators/qemu
emulators/qemu-devel
ftp/filezilla
ftp/wput
ftp/wzdftpd
games/pokerth
irc/bitlbee
irc/ctrlproxy
irc/weechat
japanese/jd
lang/gnustep-base
mail/anubis
mail/claws-mail
mail/libvmime
mail/xfce4-mailwatch-plugin
multimedia/ffmpeg
multimedia/libav
net/csync2
net/glib-networking
net/gtk-vnc
net/morebalance
net/net6
net/remmina-plugin-vnc
net/samba4
net/samba41
net/sixxs-aiccu
net/tigervnc
net/vino
net-im/gloox
net-im/jabber
net-im/loudmouth
net-p2p/gtk-gnutella
net-p2p/ncdc
news/nzbget
security/gnomint
security/gsasl
security/libprelude
security/libpreludedb
security/openvas-libnasl
security/openvas-libraries
security/openvas-plugins
security/prelude-lml
security/prelude-manager
security/py-gnutls
security/shishi
sysutils/heartbeat
textproc/iksemel
www/gurlchecker
www/hydra
www/mod_gnutls
www/wwwoffle
www/xombrero
net-im/jabber.el
editors/emacs-devel
multimedia/vlc
And some linux ports of Acrobat Reader and CUPS libraries. There is also a module for Apache.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
Please define "as quickly as desired". Debian was fixed on the 3rd of March which is the date of the Debian Security Advisory, that's pretty quick to me. I wonder exactly why this article pops up now, when it's been a long time we've been all patched.
The difference is that with closed source, the only exploits that are discovered by third parties and get fixed are those that have already been exploited, and already resulted in vulnerable systems.
With open source, exploits can potentially be discovered and reported by other parties *before* the exploit has actually ever been used, meaning that a fix is available at the same time that the exploit becomes public knowledge, and anyone who updates as soon as such an exploit becomes known has a higher level of confidence that their system will have not yet been compromised. The very fact that open source may also make it easier for a third party to find a way to exploit a previously unknown vulnerability also makes it easier for a third party to take action that will lead to the issue being corrected.
With open source, such critical bugs can and actually *will* be fixed, a sufficiently technically competent individual could even do so themselves, where with closed source, absolutely everyone is at the whim of the development team's schedule.
File under 'M' for 'Manic ranting'
Free/Open code is a necessary but not sufficient condition for security.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
and the blue screening of classic windows provides a hard shield against any rogue processes owning the machine for too long
Who said anything about aliens? The reptilians are actually an earlier sentient species of Earthling, driven underground by the asteroid impact that ushered in the extinction of the dinosaurs. They're only meddling in primitive Human politics to keep us from interfering with their space program.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
For all the speed with which Debian rolled out a patch, it'll still be months or years before this patch makes it into the wild on all the systems it's being used on.
When you show me the OS that has a patch for idiot, lazy or incompetent operators, I will buy you a beer.
Forget openwrt... How about all the ISP provided "Firewalls" that are total garbage, have one password, and can not be updated?
The irony, of course, is that most people haven't read Microsoft's EULA which effectively says 'Not only are we not responsible if Windows fails, but we'll sue you if you try to fix it yourself.'
This is really gonna bite the hundreds of millions running XP who will be orphaned this year when Microsoft stops supporting it. Not only do they face the prospect, in a matter of weeks, of never again seeing security updates from Microsoft, but it will be illegal to even try to fix future bugs themselves (or hire a third party to do it).
This last bit is something that Linux users have as a right
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Well, there is this one crazy project.