Slashdot Mirror
Just-Announced X.Org Security Flaws Affect Code Dating Back To 1987
An anonymous reader writes Some of the worst X.Org security issues were just publicized in an X.Org security advisory. The vulnerabilities deal with protocol handling issues and led to 12 CVEs published and code dating back to 1987 is affected within X11. Fixes for the X Server are temporarily available via this Git repository.
It's open source! Surely dedicated multitudes of programmers have been dutifully poring over the code for decades, searching high and low for potential flaws because ... well, just because it's there! Surely!
Configure the X server to prohibit X connections from the network by passing the -nolisten tcp command line option to the X server. Many OS distributions already set this option by default, and it will be set by default in the upstream X.Org release starting with Xorg 1.17.
I don't see that program listed in my Start menu. Whew, guess I'm safe!
Open Source does not guarantee that all of the bugs will be found, it merely guarantees that all of the bugs can be found.
One of the big claims is because you can't look at closed source code, bugs go undetected for longer.... 1987?
Or is that project even still around?
There are remnants of DOS code in the newest versions of Windows. Has anyone done a proper analysis of MORE or XCOPY to ensure they're perfectly safe? Those pieces of code go back significantly further than 1987...
Original story:
http://it.slashdot.org/story/1...
CCC talk:
http://media.ccc.de/browse/con...
While many people seem to say that, I don't believe that's the actual claim. I think the claim is that it's easier to find bugs in free/open source software because the code can be read by everyone. That is, it's more likely that if there is a bug it will be found and fixed. While that may imply, to a certain degree, that bugs can go undetected for longer in closed source software it certainly doesn't state it outright. And in large code bases like X.org it's hard to imagine that old pieces of code that haven't been looked at in a long time wouldn't have some rather large vulnerabilities. At least now some of them have been found and patched.
Plus I think it's also important to think about it from this angle: Do you have any examples of closed-source software that has been in use since 1987 that hasn't had any bugs discovered recently?
So, what exactly is impacted here? Are all X11 implementations affected, or just XFree86 and X.org? I'm seeing SGI sources listed as impacted, which would point to any X11 implentation that uses GLX being impacted (including Xsgi on my IRIX systems), and seeing the age of the bug, I would imagine it would be more proper to point to things based on XFree86 rather then X.org. People forget that X11 is bigger then X.org, and the X.org team wasn't always the only game in town (if they didn't have a monopoly we wouldn't be arguing about Wayland....).
I'm starting to think GNU is the problem with "GNU/Linux" these days.
Zealots are deniers.
The problem is there are enough vocal Zealots to proclaim that how a product is licensed some how makes it superior/inferior to an other.
But in general the more confident you are in your products superiority, the more problems you ignore or don't bother looking for.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Why on earth are so many systems not running a non-priveledged X is the real question we should be asking.
X.org is developed by the freedesktop.org community, right? And systemd is also developed by the freedesktop.org community, right? So if X.org's code has serious flaws going back decades, and the freedesktop.org community didn't detect them sooner, then I think we should assume (more than we already do) that all of their software, especially newer and immature software like systemd, has similar undetected flaws. This should cause Linux distros like Debian to immediately rethink the decision to integrate systemd. In fact, the safest thing to do at this point would be for Debian to completely remove systemd, until is has been proven not to contain flaws.
Don't forget to compare bugs from active exploits in use:
When I read about Linux vulnerabilities, they are bugs, and -could- be used for exploits.
When I seem to read about Windows vulnerabilities, they are -actively being exploited-, which means it isn't just a security problem, but the hackers are already gorging themselves at the buffet table and swilling the champagne at this second.
The manner in which you state it seems far more common in strawman arguments than the actual arguments being made. Most claims regarding FOSS security are rooted in averages in situations with all other factors being roughly equal.
This is my signature. There are many like it, but this one is mine.
It turns out that nobody likes having to retrain their talking points when reality intervenes. Just as much, nobody seems ready to discuss a nuanced issue that cannot be boiled down to a few talking points.
I don't suppose M$ has some kind of command-line mode for their servers? Some sort of Disk Operating System which could be used to provide a runtime environment for applications and services without requiring the use of a large, resource-hogging graphical interface which (as has been pointed out) is a great place to find exploitable code.
It's proprietary code! Surely the vendor has the most noble and idealized motives in making sure their code's not merely good enough to sell, it's actually good, with highly trained and competent professionals dedicated to ensuring their customer's safety after they take the money.
Just to clarify, if we use X10 we're good?
Help! I'm a slashdot refugee.
OOOOOlllllllddddddd....
There is actually a windows version (Server Core, IIRC) that boots to a terminal ... window. Better than nothing, I guess.
MS has had a fully-supported "no GUI" server option since Server 2012, but has been possible to admin CLI-only, without 3rd part add-ins, since 2008 (though the GUI would still be running, if you don't provide remote access to it, it might as well not be), and with 3rd-prty add-ins since 2003.
However, managing multiple Windows servers is more about group policy than logging into any servers, GUI, CLI, or carrier pigeon. I've worked with management systems for 1000s of Windows servers, and the only reason you'd ever log into a server is to recover if something went horribly with a new deployment, and you wanted to find out why (to debug your deployment - just recovering the server was automatic).
Socialism: a lie told by totalitarians and believed by fools.
"code dating back to 1987 is affected "
Wayland is better, because it can have only bugs that affect code dating back to 2008 :)
Anybody who's really looked at security around X11 has known for decades that it isn't that great.
I even remember that as recently as a year ago, ATI's drivers specifically tell you to use "xhost +" to enable GPU compute jobs using ATI devices, which resulted in a lot of "LOL NOPE" in the HPC industry. (It's trivial to root a machine that has had "xhost +" executed inside an X11 session.)
X11 having critical security holes should surprise no one. There's a reason internet-facing servers don't have X11, and it's not just because you don't need a GUI sucking up resources.
On the other hand, I'm thoroughly grateful that somebody decided to do something about it.
-- Sometimes you have to turn the lights off in order to see.
One of the big claims is because you can't look at closed source code, bugs go undetected for longer.... 1987?
Still a quicker fix than the two in Windows dating back even further, one of which is still vulnerable remotely.
Still much better than the greater-than-zero number of zero day exploits in Windows you don't even know about, nor could even prove is a low number.
Might as well make up a number like "Windows still contains 20,000 unpatched exploits" for all you can tell and prove to us.
So yea, 2-3 is much much less than 20000, so linux still beats windows with its speedy bug fixes!
SO: what do these bugs mean for someone running say Debian Wheezy with its out-of-the-box X and iptables settings for typical consumer desktop use with a home router ie not a web server? What is there that makes that system vulnerable to attack?
Those zer0-day script kiddies I hired must have been distracted by the drop in Xbox' price.
"I don't suppose M$ has some kind of command-line mode for their servers? "
MS has had a command line interface (Powershell) for administrating servers for quite awhile a while now moron. It even comes with a handy SDK that helps writing installers and automating system tasks from the application layer when required. The fact you don't know that means you turned off more than your GUI. I would also question your claim of being a respectable Linux administrator if you have to ask such a stupid question.
X.org didn't exist until this century.
Linux suffers from too much "add feature Y asap" versus doing security audits on the code. All Open Source programs should go through a year of security audits, for starters. Who knows what is lurking in that old code?
Just tell me that Motif is still safe.
> how a product is licensed some how makes it superior/inferior to an other
Ok, take an old radio. You know, those that were repairable, that you could open up with a screwdriver.
Now, ruin all screws so that it can't be opened anymore. Use glue, melt it, whatever.
Now, tell me with a straight face that it has not become inferior just because, technically, it sounds the same and receives the same.
Under the Hood, Windows 7 Is Vista's Twin
X is dying.
Well....I would stick with OPEN LOOK just to be sure.
I'm starting to think GNU is the problem with "GNU/Linux" these days.
One of the big claims is because you can't look at closed source code, bugs go undetected for longer.... 1987?
Well, there are two things to respond to here. Covarity is a company that was spun off from a university research project that used software to automatically check other software for bugs and programming errors. It was enhanced, and then its use was underwritten by the US Department of Homeland Security to check the GNU/Linux ecosystem (the kernel plus about 50 other large pieces of software). Instead of 'mere speculation' by some armchair quarterback, microsoft zealot or slashdot pundit, they ran this thing against all of this software. They then took the source of large closed source software (including operating systems the poster would embrace like a $2 streetwalker: eg MS Windows). And they found that GNU/Linux had 20x fewer bugs than commercial software, and the bugs that were there were far less dangerous than the commercial software. 2. The bug found here (assuming Covarity went over the X-windows system), was too subtle for Covarity to find. 3) Its better to find a bug from 1987 and fix it, than to go on about how good your software is, and have have someone break it when its a greater span of years than from 1987 to now.
Well if the new radio's are smaller, lighter and do not need to be (better components, less moving, or parts that can move...) repaired, and offer near identical sound. Then Yes your old radio is inferior to the new one.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Ubuntu would fix the X.org problems in their latest version. Nothing like the GUI locking up and then going into a command prompt and seeing xorg sucking up all the system resources.
whoooooooosh. you hear that AC?
Who said I was respectable?
What's it like getting your ass kicked by apk + downmodding to hide it 20x http://tech.slashdot.org/comme... ?
What's it like getting your ass kicked by apk + downmodding to hide it 20x http://tech.slashdot.org/comme... ?