Slashdot Mirror
Severe Flaws Found In Libarchive Open Source Library (talosintel.com)
Reader itwbennett writes: Researchers from Cisco Systems' Talos group have found three memory corruption errors in the widely used open-source library libarchive that can result in arbitrary code execution and can be exploited by passing specially crafted files to applications that contain the vulnerable code. "The library is used by file and package managers included in many Linux and BSD systems, as well as by components and tools in OS X and Chrome OS," writes Lucian Constantin. "Developers can also include the library's code in their own projects, so it's hard to know how many other applications or firmware packages contain it." (Original blog post) So, while the libarchive maintainers have released patches for the flaws, it will likely take a long time for them to trickle down through all the affected projects.
For crying out loud! How long must this continue? We need to start using the Rust programming language and we need to start using it now! If you don't know what Rust is, let me inform you. The Rust web site describes it as "a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety." It has "guaranteed memory safety" and it has "threads without data races" and you get all of this with "zero-cost abstractions"! Rust doesn't just make programming safe. Thanks to its code of conduct the Rust community is a safe space free of intolerance and prejudice, too.
Essentially, Rust is what C and C++ should have been all along. This submission shows that we badly need what Rust offers. We need the safety of Rust, and we need it now! I don't think we really have any choice. We need to start using Rust for everything! It's the only way we can be sure that the software we're writing is safe and secure.
But Windows is safe?
I'm going back to DOS 2.11 on my bone stock original IBM XT.
HACK THAT! HA!
I keep hearing about how safe Mozilla's new Rust lang is.
Let's say we had a whole OS written in Rust.
It is Rust top to bottom.
The boot loader is written in Rust.
The init system is written in Rust.
The kernel is written in Rust.
The libs are written in Rust.
The apps are written in Rust.
Everything about this OS is written in Rust.
Would this OS be invincible to flaws like this?
Why doesn't Mozilla make an OS that is totally written in Rust?
What really amazes me is how people seem completely oblivious to D. The D programming language was the logical heir and successor to C, fixing many of its flaws and extending it in relevant ways.
C|N>K
Is not publicly available yet, why is Talos posting a public blog (and howto) for a vulnerability without proper time for the fix to trickle out to major distributions ?
Isn't that a no-no? Especially if you claim to be a 'security specialist' ?
Really? I've not been able to find anything other than a new release. The patches might be in git, but they are not easily found.
Generate the diff yourself using the newest source code and the source code of the release before that. It's not hard to do.
"That's because software developers in general do a poor job of tracking vulnerabilities..." he writes, and then cites another article he wrote.
Don't believe what I wrote? Well just look at this other thing I wrote.
But how am I supposed to tell which changes are due to the vulnerability and which are due to the 12 new archive formats that were invented last week? There's just so much new stuff in the world of archives, I'll never figure it out!
They are in git, indeed:
CVE-2016-4300: https://github.com/libarchive/...
CVE-2016-4301: https://github.com/libarchive/...
CVE-2016-4302: https://github.com/libarchive/...
append .patch to the url in order to get an apply-able patch.
But better update the whole library, usually there is lots of security related fixing going on when a security researcher takes a look at the code. Also, the git commit log may lie, and in fact some other commits fixed the issue, its just not marked this prominently.
The best policy is always to not copy the whole library into your source tree, but making downloading the library part of the build process. If you have to modify the library some way, its best to upstream those changes, but if you don't want to do it for some reason, or can't do it, then you can create patch files, and apply the patches as part of the build process as well. Updating the library then gets as easy as changing an url and rebuilding + checking that all the patches applied + retesting.
It is Rust top to bottom.
It probably wouldn't be very good on mobile machines because, as we know, Rust never sleeps.
This is one of the whole ****ing points of using shared libraries, that fixes can be put in place once instead of descending into an auditing and update uncertainty nightmare. But it seems with modern projects like docker, snap, flatpak et al we are descending down the idiot hole. Why are modern developers failing to learn well understood lessons? Have we failed to pass on the knowledge or is it being ignored?
The problem is that too many modern devs are Hipsters/Millennials. Their entire culture and mindset revolves around them being sure that they know exactly what's right, even when they're clueless. They apply this philosophy everywhere, all of the time. They take a touchy/feely approach to everything, rather than applying logic, principles, and knowledge. Thanks to them being part of a demographic bulge, they have used their large numbers to quickly overwhelm everybody else.
That's why the software UIs they create are so goddamn awful. Hipsters/Millennials throw out decades of accumulated knowledge about good UI design. They don't bother to ask the users what they want or need. Instead, Hipster/Millennial UI designers make a UI that they think looks pretty, and then they tell the users to shut the fuck up and use it. Firefox and GNOME 3 are superb examples of this.
It's the same for databases. Hipsters/Millennials throw out decades of accumulated knowledge about relational databases and the ACID principles. Instead they store everything in NoSQL databases, which are typically nothing more than hash tables. Then they act surprised when their data becomes inconsistent, assuming it isn't lost completely!
And it's the same for building and deploying software. They've thrown out decades of accumulated knowledge about how to build and deploy software. Hipsters/Millennials are all about magical "package managers" and "containers", and sometimes even "containers" nested within other "containers"! They don't care, or likely don't even realize, that these are bad ways of doing things.
Maybe the next generation of developers who come after the Hipsters/Millennials will have a more modest attitude, and will be willing to learn from the knowledge we have accumulated over time, rather than being like the Hipsters/Millennials who reject knowledge.
Good luck updating all your vulnerable software, Windows users!
There are classes of bugs that would not show up in Rust programs. But most languages can make the same claim (for different classes of bugs). The only exception I can think of is (non-macro) assembler.
Probably the safest reasonable language is SparkAda, which is a subset of Ada. But it's not really convenient to use it.
And, honestly, a complete language is going to have entire classes of bugs that cannot be detected. This is sort of a corollary to the halting problem.
That said, Rust claims to be immune to classes of bugs that make concurrent execution difficult. I prefer message passing, though.
I think we've pushed this "anyone can grow up to be president" thing too far.
The 1% and their thugs want each and every computer to be hackable. Just read what Fiorina and Hillary say.
THAT is why the crap language C is pervasively used. It keeps our computers open for 1% inspection. It facilitates CONTROL of the 99% by the 1%.
I guess the correct term would be Curse Of The 99%.
"resistance is futile, give us your data"
FUCK THAT !
Rot in Hell.
You probably will see OSes written in Rust soon. Rust isn't really ready yet, it's still changing pretty fast as a language and it lacks some features that you'd want, things that C++ already has. But it's getting there.
Microsoft actually created something like what you describe with their own safe language, it was called Midori. You can read about it on Joe Duffy's blog.
I don't want my computer to rust, that sounds terrible!