Slashdot Mirror
Just-Announced X.Org Security Flaws Affect Code Dating Back To 1987
An anonymous reader writes Some of the worst X.Org security issues were just publicized in an X.Org security advisory. The vulnerabilities deal with protocol handling issues and led to 12 CVEs published and code dating back to 1987 is affected within X11. Fixes for the X Server are temporarily available via this Git repository.
It's open source! Surely dedicated multitudes of programmers have been dutifully poring over the code for decades, searching high and low for potential flaws because ... well, just because it's there! Surely!
Open Source does not guarantee that all of the bugs will be found, it merely guarantees that all of the bugs can be found.
One of the big claims is because you can't look at closed source code, bugs go undetected for longer.... 1987?
Or is that project even still around?
Original story:
http://it.slashdot.org/story/1...
CCC talk:
http://media.ccc.de/browse/con...
While many people seem to say that, I don't believe that's the actual claim. I think the claim is that it's easier to find bugs in free/open source software because the code can be read by everyone. That is, it's more likely that if there is a bug it will be found and fixed. While that may imply, to a certain degree, that bugs can go undetected for longer in closed source software it certainly doesn't state it outright. And in large code bases like X.org it's hard to imagine that old pieces of code that haven't been looked at in a long time wouldn't have some rather large vulnerabilities. At least now some of them have been found and patched.
Plus I think it's also important to think about it from this angle: Do you have any examples of closed-source software that has been in use since 1987 that hasn't had any bugs discovered recently?
So, what exactly is impacted here? Are all X11 implementations affected, or just XFree86 and X.org? I'm seeing SGI sources listed as impacted, which would point to any X11 implentation that uses GLX being impacted (including Xsgi on my IRIX systems), and seeing the age of the bug, I would imagine it would be more proper to point to things based on XFree86 rather then X.org. People forget that X11 is bigger then X.org, and the X.org team wasn't always the only game in town (if they didn't have a monopoly we wouldn't be arguing about Wayland....).
I'm starting to think GNU is the problem with "GNU/Linux" these days.
Zealots are deniers.
The problem is there are enough vocal Zealots to proclaim that how a product is licensed some how makes it superior/inferior to an other.
But in general the more confident you are in your products superiority, the more problems you ignore or don't bother looking for.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
The manner in which you state it seems far more common in strawman arguments than the actual arguments being made. Most claims regarding FOSS security are rooted in averages in situations with all other factors being roughly equal.
This is my signature. There are many like it, but this one is mine.
I don't suppose M$ has some kind of command-line mode for their servers? Some sort of Disk Operating System which could be used to provide a runtime environment for applications and services without requiring the use of a large, resource-hogging graphical interface which (as has been pointed out) is a great place to find exploitable code.
It's proprietary code! Surely the vendor has the most noble and idealized motives in making sure their code's not merely good enough to sell, it's actually good, with highly trained and competent professionals dedicated to ensuring their customer's safety after they take the money.
Doesn't prohibiting network connections to the X server rather defeat one of the major features of X?
Granted, I think I usually am tunneling my X connections through ssh, so perhaps this doesn't apply as widely as it did a few years ago.
Just to clarify, if we use X10 we're good?
Help! I'm a slashdot refugee.
I USE remote X connections. Mostly over the LAN.
Yes, most Linux distributions seem to have used -tcp nolisten for quite a while. ssh -X still works fine and is very useful (IMHO).
Why can't you use ssh -X ?
They are, in fact. It's just that you can still gain access to your non-privileged X server, and have access as the user running X. You can then make it run any shellcode you want, or return to libc and run some shell commands (doesn't require writable/executable memory this way), thus allowing for injection of a local privilege escalation attack or some sort of information leak (e.g. concurrent brute forcing of passwords). In the most basic case, landing as the non-privileged X user allows you to inspect your own processes, i.e. the X server itself, and keylog and harvest passwords.
Support my political activism on Patreon.
Yes.
MS has had a fully-supported "no GUI" server option since Server 2012, but has been possible to admin CLI-only, without 3rd part add-ins, since 2008 (though the GUI would still be running, if you don't provide remote access to it, it might as well not be), and with 3rd-prty add-ins since 2003.
However, managing multiple Windows servers is more about group policy than logging into any servers, GUI, CLI, or carrier pigeon. I've worked with management systems for 1000s of Windows servers, and the only reason you'd ever log into a server is to recover if something went horribly with a new deployment, and you wanted to find out why (to debug your deployment - just recovering the server was automatic).
Socialism: a lie told by totalitarians and believed by fools.
Yes, most Linux distributions seem to have used -tcp nolisten for quite a while. ssh -X still works fine and is very useful (IMHO).
Very long time. Most typical server installations don't even install X, so if you are wanting to exploit this, you are going to have to look really hard for somebody on your LAN running an ancient distro who's disabled the firewall and other remote auth stuff.
These days for heavy remote X use you use stuff like Xpra, also over SSH, as it can leverage hardware encoders which the X protocol didn't have at its disposal back when it was designed.
Someone had to do it.
Anybody who's really looked at security around X11 has known for decades that it isn't that great.
I even remember that as recently as a year ago, ATI's drivers specifically tell you to use "xhost +" to enable GPU compute jobs using ATI devices, which resulted in a lot of "LOL NOPE" in the HPC industry. (It's trivial to root a machine that has had "xhost +" executed inside an X11 session.)
X11 having critical security holes should surprise no one. There's a reason internet-facing servers don't have X11, and it's not just because you don't need a GUI sucking up resources.
On the other hand, I'm thoroughly grateful that somebody decided to do something about it.
-- Sometimes you have to turn the lights off in order to see.
Temporarily disabling a feature is not the same as permanently doing so. It's like saying that you always need to run as root. You don't. You only need to enable root level access when it's actually needed. The same goes for outward facing network services.
Similarly MacOS doesn't enable the ssh server by default.
A Pirate and a Puritan look the same on a balance sheet.
Just tell me that Motif is still safe.
That's not a problem that is unique to Linux however. Many commercial products have the same issues - the marketing and planning people want new features as that helps them sell upgrades and maintenance, and in the past those sorts of things were prioritized higher than things like a security audit which management concluded weren't something that one could sell.
It is only when customers demand security audits of the products that they buy that this will change.
I am interested in Wayland, but question is - if the same people who wrote X11 are now writing Wayland, why would we trust Wayland to be any better, or not have the same bugs? Are the bugs related to X's remote access, which Wayland dumps for RDP/VCN?
Windows 7 was the product release of the beta version otherwise known as Windows Vista.
I commonly use XDMCP because it's simply easier and faster for a handful of the systems I work with (given, the SGI's are quite slow by today's standards...). Also trying to explain that to some Windows people when they insisted they needed to install Oracle DB on Solaris systems (they wanted me to tell them how to get a remote GUI on Solaris 9 and 10) it was far easier to point them to XDMCP.
I'm starting to think GNU is the problem with "GNU/Linux" these days.
Well....I would stick with OPEN LOOK just to be sure.
I'm starting to think GNU is the problem with "GNU/Linux" these days.
a Start menu, didn't Microsoft remove that for security reasons?
No one of the people who designed and coded X11 in the eighties are now busy on Wayland that I know of.
Well if the new radio's are smaller, lighter and do not need to be (better components, less moving, or parts that can move...) repaired, and offer near identical sound. Then Yes your old radio is inferior to the new one.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Ubuntu would fix the X.org problems in their latest version. Nothing like the GUI locking up and then going into a command prompt and seeing xorg sucking up all the system resources.
Who said I was respectable?