Zero-Days Hitting Fedora and Ubuntu Open Desktops To a World of Hurt (arstechnica.com)

An anonymous reader writes: It's the year of the Linux desktop getting pwned. Chris Evans (not the red white and blue one) has released a number of linux zero day exploits, the most recent of which employs specially crafted audio files to compromise linux desktop machines. Ars Technica reports: "'I like to prove that vulnerabilities are not just theoretical -- that they are actually exploitable to cause real problems,' Evans told Ars when explaining why he developed -- and released -- an exploit for fully patched systems. 'Unfortunately, there's still the occasional vulnerability disclosure that is met with skepticism about exploitability. I'm helping to stamp that out.' Like Evans' previous Linux zero-day, the proof-of-concept attacks released Tuesday exploit a memory-corruption vulnerability closely tied to GStreamer, a media framework that by default ships with many mainstream Linux distributions. This time, the exploit takes aim at a flaw in a software library alternately known as Game Music Emu and libgme, which is used to emulate music from game consoles. The two audio files are encoded in the SPC music format used in the Super Nintendo Entertainment System console from the 1990s. Both take aim at a heap overflow bug contained in code that emulates the console's Sony SPC700 processor. By changing the .spc extension to .flac and .mp3, GSteamer and Game Music Emu automatically open them."

Comments

go

[Anonymous Coward]

Captain America

Play Audio on Linux?

[Anonymous Coward]

since the advent of Pulseaudio this has been very much hit and miss.
None of my Linux systems have the sound drivers loaded. Do you really need servers to play some carefully crafted (c)RAP?
I think not.

Re:Play Audio on Linux?

[houghi]

What if they are used as a music server? And just because you are not vulnerable does not mean you can just ignore it.
Becquse YOU will be getting the spam send to your server costing you electrcity and time and efford and some will get through.

Re: Play Audio on Linux?

[Anonymous Coward]

No sound drivers on your systems? Are you sure?

I distinctly remeber many times installing software that had nothing to do with sound having a bunch of audio dependencies.

That's one of my criticisms of FOSS developers, they can be a bit crazy with their dependencies.

Re:Play Audio on Linux?

[Anonymous Coward]

Never had any issues after a
apt-get purge pulseaudio avahi-daemon

Re: Play Audio on Linux?

[Anonymous Coward]

> That's one of my criticisms of FOSS developers, they can be a bit crazy with their dependencies.

You know that because you can see them. Fear also what you cannot see -- like closed software -- because in this case "ignorance is woe", "only the paranoid survive" etc. etc.

> No sound drivers on your systems?

For servers, that may be possible and even desirable. Even if it is a music server, e.g. like in a streaming music file server, that could be possible, I presume.
The only case one would need a music server with sound would be for streaming the music itself (the raw audio, I mean). But why would one want that? If the original audio is mp3 or ogg, send the compressed file to the client; if it's flac, do the same, though with less network savings. If you need say, to reach Bluetooth speakers, put a minimal audio in between and let the server have no audio.

For desktops, that should be possible, too. But why? Because you use a client desktop for internet banking or remotely logging in (telecommuting) to work. In fact, there's not much reason to have multimedia of any kind on that machine. Java/javascript is already dangerous enough.

One of Linux' advantages is the possibility of keeping the old machine in use, when you buy a new one. Having a computer set aside for such secure uses is not that much far-fetched.

Re:Play Audio on Linux?

[Opportunist]

What if they are used as a music server?

I think both server admins using Linux that way know about this flaw...

Re: Play Audio on Linux?

[Sarten-X]

> That's one of my criticisms of FOSS developers, they can be a bit crazy with their dependencies.

You know that because you can see them.

My day job involves creating itemized lists of dependencies for a very large project. I can assure you that both open- and closed-source software is horrible, though I do have to admit that open-source tends to be a bit worse on the unexpected-dependency front, for a few reasons.

In closed software, there is a lot of effort spent recreating common elements. I cringed when I found a file named "sort.dll", but it's probably exactly what it looks like: A developer didn't want to depend on outside code, so they wrote a sorting function as a library. Without an audit like mine, nobody would ever notice the silly practice of rewriting what's probably built into their language, and readily available in other third-party libraries.

Open-source software, then, is more transparent. If a FOSS project reimplements a sort, it will eventually be discovered and mocked until it uses the third-party library. This is fine, as it also reduces the complexity and size of the FOSS project. However, it does then lead to a bit of shock to see that the "widget" package depends on 53 other packages including "libfoo", "libbar-dev", "libbaz-ng-perl-1.03-sparc", and so on. Compounding that, it's also trivial for the FOSS project to actually use that library, because the library itself is likely FOSS, with a compatible license. Even if all your project needs is a single function, there's no cost to depend on an entire library... and a different one for a different small part, and so on.

The tendency to include a long list of dependencies makes my job worse for FOSS, because I can't just shrug my shoulders and give up after listing the one software package without any named dependencies. On the whole, however, it does ultimately lead to a smaller (and more traceable, and higher-quality) codebase for a final system, which is why the hardware requirements for a FOSS system tend to be much lower than an equivalent system based on closed-source packages.

Re:Play Audio on Linux?

[pr0fessor]

What if it's not just some server? It could easily be kodi and emulation station...

Re: Play Audio on Linux?

[Rockoon]

Without an audit like mine, nobody would ever notice the silly practice of rewriting what's probably built into their language, and readily available in other third-party libraries.

Have you not considered the possibility that the developer wanted different runtime guarantees than the standard library sort provided?

There are very good reasons to use something other than the bog standard quicksort with a heap sort fallback (aka introsort) in a lot of scenarios, be they server services or even games.

No, I didnt think so, nor did you find out why the programmer did include his or her own sort, as evidenced by you stating assumptions about it.

For either games or server services, that standard library introsort would never be used if I was head of the development team. No chance in hell does it perform better than radix sort (for game scenarios) or has the best possible worst case runtime (for server services.) Its a complete no-no to use it.

Re: Play Audio on Linux?

[Sarten-X]

Have you not considered the possibility that the developer wanted different runtime guarantees than the standard library sort provided?

Yes, I have, and find it extremely unlikely that the programmer had any idea what he was doing. Mostly that analysis comes from the knowledge that the particular software package was an interface for a low-speed IO device, and could have probably have performed just fine if it relied on a bubble sort. Then again, I've also worked with the programmer responsible for that particular package, and it wouldn't surprise me to find that he had actually written his own bubble sort...

There are very good reasons to use something other than the bog standard quicksort with a heap sort fallback (aka introsort) in a lot of scenarios, be they server services or even games.

That's not really disputed, but there are third-party libraries that provide many sorting options, without having to write (and debug, and maintain) it yourself. If you have a very good reason to use a particular algorithm, find a library that provides it.

For either games or server services, that standard library introsort would never be used if I was head of the development team. No chance in hell does it perform better than radix sort (for game scenarios) or has the best possible worst case runtime (for server services.) Its a complete no-no to use it.

It sounds like you don't really know much about data processing scenarios. I once had a mentor who said something to the effect of "If you're thinking about your sorting, you're doing something wrong". The reality is that except for the most demanding applications (like rendering on the GPU), the programmer shouldn't need to think about what sorting algorithm is being used. Rather, the programmer's primary concern should be writing clean and maintainable software, and leave the exact implementation to someone else, who only needs to write according to an API specification. If that spec includes performance targets, then it will require particular algorithms. Otherwise, anything reasonably efficient will do the job, and it becomes a point of testing to compare different libraries for required functionality.

For example, let's consider the high-speed sorting used to render a 3D game world. The game programmer just needs to build the world in the game engine, and the engine will handle the sorting. The engine programmer only needs to worry about getting the data from the game library to the renderer, and the renderer will handle the sorting. The render engine programmer finally has to think about sorting algorithms... but his choices are driven primarily by the data structures present and the hardware optimization available, which may drastically change the run times of algorithms. With the appropriate hardware available, the render engine may pass off sorting to the GPU, using some of the SIMD processing capability to (for example) run a Batcher sort, rather than a radix sort on the CPU. I am told that's actually what nVidia's "game-ready" drivers do: They forcibly replace a game's poorly-optimized code with equivalents that use nVidia's hardware more effectively.

On the server side, I will refer to another aphorism: "Premature optimization is the root of all evil". If using a custom sorting method means moving data around outside of your database, you're not going to get a performance improvement. If you're concerned about worst-case performance because you might see it in real use, you should be thinking about security, not performance. If you're optimizing the application to improve user load performance, it's usually cheaper to just buy more hardware and run more back-end servers. In short, sorting is rarely the most effective target for optimization, so it's generally not worth the cost to improve, when efforts could be focused elsewhere.

Re: Play Audio on Linux?

[Immerman]

If sorting is occurring in a performance-critical part of your code, that's probably a good idea.

But it's also hard to deny that a lot of developers will write their own sorts, etc. based on an imagined need that isn't actually there, and likely introduce needless bugs and quite possibly performance losses into their program as a result. Because let's face it - it's seriously nontrivial to write a bug-free sorting library that can outperform the optimized quicksort (or whatever) that's probably included in your languages standard library.

Radix is possibly an exception as it's relatively straightforward to implement, but comes with rather abysmal memory overhead if you're not able to exploit the existing data list infrastructure. (For those unfamiliar - radix sorting a linked list can be done with very little (and O(1) ) memory overhead, *if* you can reuse the original list nodes to store the data within the intermediate bins). I can only assume that, along with the limitations of requiring a fixed-length key, explains the fact that it's not more commonly included in general-purpose libraries.

That, and perhaps the fact that virtually all descriptions I've seen show it using base ten digits, which severely hobbles its performance compared to using base 256 (or more) instead. You would hope such a large reduction of complexity constants would be obvious, but I've been dismayed at how many otherwise competent people have completely overlooked it - some even initially questioned whether it was actually a radix sort at all.

Re: Play Audio on Linux?

[Anonymous Coward]

Mod up. Suitable smackdown to clueless GP.

Re: Play Audio on Linux?

[arth1]

In some cases, a complete sort isn't needed either, just a pigeonholing routine with adjustable bucket sizes. Using a full sort routine can then be very much slower than needed.

But what the GP post alluded at is that the interdependencies of 3rd party libraries can be humongous. It may be easy to "just" link with a library that provides a small routine, but when that in turn pulls in 10 other libraries, which in turn pull in 20 more, it becomes both a dependency nightmare and bad bloat.
So in some cases, it pays off to write your own equivalent or link with an .a, even if it means you have to recompile your code to fix security holes instead of automatically get it with a library.
If you single it out in your own .so, at least you won't have to rebuild all, but just that ,so

Re: Play Audio on Linux?

[SQLGuru]

OR........

It could have been a wrapper around the default sort algorithm that made it easier to call.....something that was more aware of the applications data structures and how to interpret them so that the default sort algorithm would work properly. Many built in sort algorithms work on primitives and built in aggregates (array, list, etc.) but if the application has some other construct, you'd want to make that call as generic as possible so that you don't have to repeat that code everywhere.

Just because a dev calls it "sort" doesn't mean it actually implements the sort algorithm.

Or you could be right and the dev is a moron. Both are possible.

Re: Play Audio on Linux?

[sjames]

A big reason for that is that most distros are designed around a minimalist base install. Anything beyond that is pulled in through comprehensive dependencies in packages. Sometimes packages do list dependencies that aren't actually necessary on the principle that an unnecessary dependency results in a working system but a missing one leaves things broken. You'll see that most frequently in GUI/desktop oriented packages.

It's a harder problem still if the software dynamically loads libraries as needed. Strictly speaking, it doesn't absolutely depend on libfoo to run and do some useful things, so you could argue that it's not a dependency, but then the user may want to do foo and get surprised that it fails with a missing library message.

Re: Play Audio on Linux?

[johnwallace123]

If only there were a way to define a generic way to tell if two "things".... let's call them "objects".. relate to each other when doing sorting. Then, for each "object", you could compare it to another "object" and see if it is less than, greater than, or equal to the other.

I know, we can make a generic "function" of an "object", and call it.... "less". If you're in a sane language (sorry, Java), you could even use the "<" symbol to compare two "objects". Then, any sort algorithm can use this function to compare two "objects" and figure out where it should go in the list.

Then, we can put this algorithm in some sort of "library"... maybe a "standard library" in which sort algorithm developers can implement different sorting methods. Then the programmer uses this "standard library" to sort his/her list of "objects".

Apologies to anyone who's using C and actually DOES need to implement their own sort, but if you're using literally any language developed in the past 30 years, you have no business implementing your own sort function outside of a homework assignment. The only potential exception to this is if you are in fact a developer of sorting algorithms, and all 3 of them know who they are.

Re: Play Audio on Linux?

[vel-ex-tech]

If you used Gentoo, this wouldn't be a problem. Crazy deps are an issue distros like Ubuntu, Windows, and Ubuntu on Windows have. Windows on Ubuntu may also have the same issues. Also systemd. And NetworkManager. And PulseAudio. And Windows 10 that apparently is attempting feature compatibility with NetworkManager's ability to completely hose networking.

In fact, just avoid anything that has deps on Poettering-ware.

Re: Play Audio on Linux?

[Immerman]

I agree with you on the dependency-minimization issues. But as I read it, that has nothing to do with the post I actually replied to, nor to the particular aspect of the GPs post they were addressing.

Re: Play Audio on Linux?

[Narcocide]

I can appreciate this concern, but yes, this is something that is easy to be sure of if you're vaguely experienced with Linux.

Re: Play Audio on Linux?

[Narcocide]

You forgot Avahi.

Re: Play Audio on Linux?

[knorthern knight]

> If you used Gentoo, this wouldn't be a problem.

Wrong. I do use Gentoo. Yes, you can create a stripped-down text-console-only install that allows you to

echo "Hello World"

from the bash prompt. And if you're only running a scientific number-cruncher program that reads a text data file and spits out calculations as text, it's great.

But try an app like Gnumeric, which is/was a great spreadsheet. I use Gentoo, and I carefully watch what gets pulled in. Over the years, Gnumeric has picked up *HARD-CODED* direct and/or indirect dependancies on dbus, goffice, harbuzz, ghostscript, etc, etc. It used to work fine without them a few years ago. Why does it need them now? Gnumeric is the major source of GNOME-related crap on my machine. If I had several million dollars, I'd hire some programmers to fork Gnumeric off of GTK and onto FLTK (Fast Light Tool Kit).

2012 rigged systemd uefi junk

[Anonymous Coward]

rip open sores

That's why they're called BAD

[ilguido]

GStreamer can run SPC file only if the GStreamer Bad Plugins (and libgme) are installed: they're called "bad" for a reason, e.g. they lack a good code review.

Re:That's why they're called BAD

[Anonymous Coward]

Since the article mentions Fedora and Ubuntu specifically, do you know whether those operating systems have GStreamer Bad Plugins installed by default?

Re:That's why they're called BAD

[ilguido]

According to the Ubuntu manifest only Base and Good plugins are installed by default, like in most distros by the way.

Re:That's why they're called BAD

[gaiageek]

Found it on my Linux Mint 17 install as gstreamer0.10-plugins-bad in the software manager. That isn't to say it was installed by default, but I don't recall installing additional plugins.

Re:That's why they're called BAD

[Anonymous Coward]

That's good to know. Sounds like this really is a non-issue. Thanks for looking that up.

Re:That's why they're called BAD

[Anonymous Coward]

quick.... excuses for blaming the user instead of acknowledging the problem how ever it occurs....

linux market share is as low as it is because of tools like you

Re:That's why they're called BAD

[TheRaven64]

There isn't really an excuse for GStreamer still running in-process. Putting the encoded packets and the decoded memory buffers in shared memory and running the decode in another process doesn't add human-detectable latency on a modern system and means that you can strip the gstreamer process of privilege entirely, so a compromise can't hurt anything. The only issue is with GPU-assisted decoding of video, because any process that has access to the GPU has a massive attack surface of buggy GPU drivers and hardware to exploit and escape from the sandbox.

Re:That's why they're called BAD

[Anonymous Coward]

Not an excuse of course, but gstreamer is mostly a toolbox. You can create the architecture you describe without a lot of work. It would be good if blocks were provided for this, so media players can do it easily.

Re:That's why they're called BAD

[MMC Monster]

And how many people have this either installed or can be made to install this?

~5 years ago, when I cared about making sure I installed all the media codecs, I installed the GStreamer Bad plugins. Only reason I don't install it now is because things work fine without it?

What would happen if someone downloaded and tried to play one of these files now (thinking they were downloading a Taylor Swift .mp3 off of Pirate Bay)? Would the OS offer to download GStreamer Bad plugin? If it did, how many users would even blink before okaying the download (after all, it's from the repositories) and entering in the administrator privileges to get things done so they can listen to their (supposed) .mp3.

Re:That's why they're called BAD

[Anonymous Coward]

Since you believe you know what needs to be done and the software is open source, I'm sure you'll have no problem checking in those changes next week as a Christmas gift to everyone, right?

Re:That's why they're called BAD

[Anonymous Coward]

It's like downloading suspect code from Github that probably works fine, but could leave you open to vulnerabilities, i.e. not an operating system level issue. It's unfair to say it's a vulnerability in "linux". It's more appropriate to say it's an issue in software for linux.

Re:That's why they're called BAD

[Anonymous Coward]

But no media player should ever play a file whose content format doesn't match the extension. File extensions are visible descriptors that help the user decide how to use a file and if it's a security risk. The most that any program should do when presented with a wrong extension is to prompt the user to rename the file.

Re:That's why they're called BAD

[Anonymous Coward]

Can't speak for Mint, but in Ubuntu, during the install the install process you are given an option to install "3rd party software for graphics, wi-fi, flash, MP3 and other media". What this does, essentially, is mark ubuntu-restricted-addons for installation, which, among other things, brings the "bad" and "ugly" gstreamer plugins.

Many people are going to select this option, since it brings much needed functionality with it. In particular, a less knowledgeable user will probably look at that option and think that maybe it is a good idea to install that.

Now consider that Ubuntu is the most popular distro, and the one that tends to be suggested to new users. This means that it is VERY likely that many users have this package installed. Which makes it a much bigger problem than what "some people" are suggesting on this thread.

Re:That's why they're called BAD

[blackomegax]

But the file type and format for NES/SNES music can/does contain opcodes. It's a properly formatted "music" file.

Re:That's why they're called BAD

[Anonymous Coward]

No one should be installing anything in the gstreamer 0.10 family, period.

Re:That's why they're called BAD

[omnichad]

What's that have to do with anything? If you're sending a file with a codec that doesn't match the extension, there should be a warning/error. If it's named .spc, fine - use the SPC codec to play it. If it's named .mp3, use the MP3 playback codec or nothing - don't search for magic bytes or try it out with every codec on the system.

Re:That's why they're called BAD

[Anonymous Coward]

Me too, same same. Looks like they are pulled in by mint-meta-codecs.

Fun, can't wait to see what I just broke.

Super safe Linux

[Anonymous Coward]

Where are all the people who said switch away from Windows? Windows isn't safe, Linux much superior and safer. Load of crap. Reason why Mac and Linux were safe was because no one used them. Now that people do, you'll see a lot more of this

Re: Super safe Linux

[Anonymous Coward]

You're retarded.

Re: Super safe Linux

[Anonymous Coward]

Who are you calling retarded, moron?

Re: Super safe Linux

[Anonymous Coward]

The retarded, buttfucking cockgobbler who posted "Super safe Linux." That person is retarded.

Re: Super safe Linux

[Flavianoep]

It's has not been a question of which is safer anymore, MacOS notwithstanding, but of which you trust. It's either an OS that can be exploited by the vendor, or a 3-letter agency, by design, or trusting that someone will audit your open source software and look for exploits, unless you have the time and expertise to do it yourself. Moreover, Linux users have never felt safe by the lower market share, but by how hard it is to have anything running on a Linux system. It's has never been about not having 14,000 viruses to infect your computer, but about having to make it executable it to have it run. Now, if I felt threatened by this new exploit, I could make my computer super safe by uninstalling the piece of software it affects. These days, the main reason for people to switch to Linux, and not to switch back to Windows, is concerns about privacy and productivity. You said that, had the exploit been found on Windows, there would be an update; now remember that Windows updates shut down the system, while Linux ones are performed while the system is running and the user is working: a reboot is not usually necessary, and when it is, it doesn't take longer than usual to turn on the computer.

Re: Super safe Linux

[Anonymous Coward]

Sigh, you didn't get the joke.

Re: Super safe Linux

[Ambassador Kosh]

A reboot on linux IS necessary for most updates to be effective. Linux uses a reference counting system for the files and this allows it to update the files while other programs are using them. However, any program still running is also using the original (insecure) version of the file. If you have a flaw in gtk for instance you would have to restart the GUI to actually fix it.

I have had to deal with servers before that where broken into that had a patch applied but program was still running and so the originally insecure version was still being used.

Linux does not force you to reboot after an update to things like libc, qt, gtk etc but the system essentially does need one. Sure you could shut down to the cli and then restart all the parts so that the newer libc is used for instance but at some point rebooting is just easier.

Re: Super safe Linux

[Anonymous Coward]

No, you just need to restart the display manager.

Re: Super safe Linux

[Flavianoep]

Is that really so? I've always heard that many or most of Linux users never reboot their systems and I felt like a noob for doing so.

Re: Super safe Linux

[Flavianoep]

The main difference is that if your computer is up and running in 45 s, it will be up and running in 45 s unless there is something wrong. It will not take more the start on a weekly basis just because of updates.

Re: Super safe Linux

[TheEden]

Never reboot is a load of crap imo, kernel patches aside, you ought to reboot every now and then just to make sure whole thing is still booting properly after patching, or yet another systemd "improvement". So that you don't get stuck right after power outage when you really need the thing running. Linux *can* run for a long time without ever rebooting - true. But "can" is not "should".

Re: Super safe Linux

[Anonymous Coward]

yes you can just restart the proccess which may be a lot of things ie rebooting is easier.

the only thing that really needs a reboot is the kernel

Re: Super safe Linux

[myowntrueself]

You're retarded.

Dude!

Differently abled!

Re: Super safe Linux

[omnichad]

On a server, you can get away with it for a much longer time. On a desktop, you're running so many varied programs that memory leaks are inevitable and a reboot is really nice. Once a month or once every 2 months is probably enough, but twice a year is the absolute minimum.

Re: Super safe Linux

[tepples]

the only thing that really needs a reboot is the kernel

Or any libraries linked into very-long-running services, such as the copy of libc used by your desktop environment or inter-process communication daemon (such as D-Bus or IBus). Restarting those would bring so much down that it'd be as much of an interruption to desktop use as a reboot.

Re: Super safe Linux

[Etcetera]

Is that really so? I've always heard that many or most of Linux users never reboot their systems and I felt like a noob for doing so.

Outside of a basically a kernel or glibc update, you don't need to reboot your system to make anything "take effect" unless you're using Linux on the Desktop, and why in God's name would you do something like that? You should, however, pay attention to security updates and make friends with 'lsof' for the most critical libraries. There's a yum plugin that can help identify things that might need to be bounced following an update, but it's not automatic by default because that's really something that an admin should be deciding on re their site's policy.

It's a good idea to reboot every once in a while just to make sure you still *can*, but that's more an operational engineering decision (better to trace back 2 months' worth of changes than 2 years) than a software decision. Recently, there have been enough kernel security updates in even the stable distros that simply applying those will take care of your safety reboot.

Re: Super safe Linux

[Ambassador Kosh]

On a server you can get away with it for longer but if you had a libc update then that means restarting pretty much everything anyways. I ran into a system with an openssl update and something had not been restarted that was a long running process and they where exploited through it.

If a library is updated you CAN restart everything that uses that library one by one. However, if you miss even one program that can become a security problem you are not aware of. That is why it is generally better to just have a maintenance window where you patch, reboot and test.

Re: Super safe Linux

[Ambassador Kosh]

Even something like an openssl update can impact more than you would remember and missing just one long running program can leave you screwed. You could try to keep track of each library and dependency and you better not make a single mistake.

It is just much easier and safer to reboot and check. Sure you can't do that in all situations but for most machines rebooting is quite fast before all services are up and running again. Why take a risk you don't need to take?

Re: Super safe Linux

[Ambassador Kosh]

Restarting them yourself is likely to be more disruptive than a reboot. When you do a reboot the system is running pre-written scripts however fast it can execute them. If you run commands yourself to do all of this then it will happen at the speed you can type stuff in. The reboot process is likely to be FAR faster and won't miss anything.

Re: Super safe Linux

[Flavianoep]

(...) unless you're using Linux on the Desktop, and why in God's name would you do something like that?

MacOS sucks in security and Windows 10 is a resources hog.

Re: Super safe Linux

[Flavianoep]

(...) unless you're using Linux on the Desktop, and why in God's name would you do something like that?

Better answer now: I don't use any especial application and own a game console.

This is great work.

[Anonymous Coward]

Still... that shows why security has to be half education and half technology. The last one, which was especially bad because a drive-by, combined Chrome ("I download by default to ~/Downloads"), stupid Desktop behavior ("I index everything I see -- oh, shiny! a media file: I'll throw that over to gstreamer") and gstreamer... see TFA.

The users expecting the system to "do everything automatically" is no different than Windows of yore running AUTORUN.INF whenever you inserted a removable medium. If there is no pushback on that front there won't be a secure system, ever [1]

[1] secure for the user, that is. If your definition of "secure" is "secure for some collusion of hardware vendor, software vendor, media companies, advertising cartels, search engines and state agencies, then perhaps.

Re:This is great work.

[Anonymous Coward]

The users expecting the system to "do everything automatically" is no different than Windows of yore running AUTORUN.INF whenever you inserted a removable medium. If there is no pushback on that front there won't be a secure system, eve]

It's called "usability"; having computers do useful things for us automatically is what makes them so useful. Next you'll be saying web browsers shouldn't display images automatically, because it's a potential security risk. Which would be ridiculous; it's useful to automatically display images in web browsers, and it's useful to automatically index media files. It shouldn't be beyond the wit of man to do so in a secure manner.

Re:This is great work.

[Anonymous Coward]

We're talking about a buffer overflow attack that could have been easily prevented by using a sane implementation language or some static security checking tool. That's a technical issue, not based on user behavior.

Re:This is great work.

[TheRaven64]

stupid Desktop behavior ("I index everything I see -- oh, shiny! a media file: I'll throw that over to gstreamer")

The real issue here is that the indexer plugins don't run in an unprivileged sandbox. An indexer should have the rights to read the file that it's indexing, to write the metadata back via IPC to the parent process, and nothing else. It's insane that anyone would create a system that runs on untrusted data without any kind of privilege separation.

Re:This is great work.

[Anonymous Coward]

> It's called "usability"; having computers do useful things for us automatically is what makes them so useful

All generalizations suck.

You are falling into the trap "doing things automatically is a good thing" == "doing everything automatically is a good thing".

As always, it's a matter of judgement; there isn't a clear bright line and the (muddy) line shifts and moves as exploits evolve.

Extreme examples (the autorun one) help having a clearer vision. My point is that taking away decision points from the user *before she's even aware of them* (the Downloads example in Chrome) helps in reducing overall security.

But if you feel comfortable in your trap, just stay there!

Re:This is great work.

[GrumpySteen]

It's called "usability"; having computers do useful things for us automatically is what makes them so useful.

True! You won't mind if we reconfigure your email client to automatically launch attachments, right? It'll be really useful!

Re:This is great work.

[Anonymous Coward]

> We're talking about a buffer overflow attack [...]. That's a technical issue [...]

Defense in depth [1], young cricket. Also, mitigation.

[1] And yes, that depth *always* should include the user. Because our aim should be to make ourselves smarter, not dumber.

Re:This is great work.

[Bobfrankly1]

And yes, that depth *always* should include the user. Because our aim should be to make ourselves smarter, not dumber.

By all means, aim high. Just know that where users (in general) are involved, that arrow is going to fall much lower then expected.

Re:This is great work.

[passionplay]

You cannot get more security by trading in your freedom. You can only be enslaved. Security is your own business. Asking someone else to do it is like giving the keys to your house and the passwords to your accounts to a third party and trusting they will do "the right thing". And since when is a game emulator library failure a distribution failure?

Re:This is great work.

[Anonymous Coward]

So then we shouldn't have to sudo to do things, that they should happen automagically?

Re: This is great work.

[Anonymous Coward]

It can if you are both smart enough to do it and dumb enough to try it.

Re:This is great work.

[Anonymous Coward]

While I would generally agree, code that reads datafiles should be safe not just for security purposes but also so that corrupt files don't cause damage.

Just get the patch already!

[Anonymous Coward]

Well, if you were in WIN10 you'd already be home! Or, just wait for Linux to patch his fuckup, that somehow is your fault!

Re:Just get the patch already!

[fuzznutz]

Well, if you were in WIN10 you'd already be home! Or, just wait for Linux to patch his fuckup, that somehow is your fault!

I am using WIN10. I'm still waiting for the patch to fix my DHCP that the last patch broke. It's too bad that I have no networking now so my wait for that patch might be a long one.

Doesn't give root access

[Anonymous Coward]

Windows is inferior to Linux for 2 reasons:
1) I believe this exploit doesn't give root access. On a Windows machine everyone logs in as administrator by default so any exploit permits the entire operating system to be taken over.
2) You can fix this problem yourself. If Windows has a defect you have to hope Microsoft decides to fix it.

Re: Doesn't give root access

[davidshewitt]

Not exactly true on 1) (unless you still run Windows XP). So long as UAC is enabled, programs run with non-admin privs by default (even under an admin account). Of course this won't stop users from blindly clicking 'Allow' without thinking about what they're doing.

Re:Doesn't give root access

[omnichad]

#1 wasn't even true in XP. You could create a standard user, but it was just a huge pain to use one. Above XP, UAC stops most exploits from taking over the system.

So where's that smug Linux dude?

[hyades1]

When the story about problems with a Win10 update was posted, some insufferable twat of a Linux user posted a comment titled "What a shitshow...grabs popcorn".

And he got modded up for it.

I wonder what he'd have to say to Chris Evans.

Re:So where's that smug Linux dude?

[Anonymous Coward]

still smug I fear, he didn't install the bad plugins...

Re:So where's that smug Linux dude?

[Anonymous Coward]

he was in russia
and the bad plugins didn't installed him for some reason

Re:So where's that smug Linux dude?

[ilguido]

I wonder what he'd have to say to Chris Evans.

That this is a bit disingenuous: the statement "GStreamer, a media framework that by default ships with many mainstream Linux distributions" is true, but the mentioned exploit does not requires just GStreamer, but a plugin from the "Bad" set, which is usually not installed by default in Linux distros.

Re:So where's that smug Linux dude?

[TheEden]

I think that post was more about msft turning w10 into software version of Orwell's 1984, rather than it being simply full of bugs (as if linux isn't full of bugs). And the actual shithow part of w10 is that there are cases when you install a correct driver for any (particullary old) hardware, it get rolled over by yet another update, so you basically forced to unfuck the system wherever microsoft decides to "enchance your user expirience" (basically every 2-3 days or so). Not to mention all the obvious spyware bundle.

Re:So where's that smug Linux dude?

[phayes]

"usually not installed by default in Linux distros" Really?

The Vanilla Ubuntu 16.04.1 desktop image I have at hand shows that it they are installed by default:

ubuntu@ubuntu16:~$ dpkg --get-selections | grep gstreamer | grep bad
gstreamer1.0-plugins-bad:amd64 install
gstreamer1.0-plugins-bad-faad:amd64 install
gstreamer1.0-plugins-bad-videoparsers:amd64 install
libgstreamer-plugins-bad1.0-0:amd64 install

Re:So where's that smug Linux dude?

[Anonymous Coward]

That's what you get for installing Ubuntu, the shittiest distro!

Re:So where's that smug Linux dude?

[Anonymous Coward]

You may have installed it, but it's not on the disc: http://releases.ubuntu.com/16.04/ubuntu-16.04-desktop-amd64.manifest

Re:So where's that smug Linux dude?

[hyades1]

The impression I got from his comment was that he was more about the update problems. and sneering at Windows users in general.

I agree totally about Win10 being Big Brother's wet dream made real. I have no plans to use it, and as much as anything else, it's the philosophy behind it. Whatever privacy leaks you fix, you can be confident MSoft will be working hard to find ways around your fixes. Their philosophy is that what you want as a user is less important than what they want to get out of monetizing you.

Re:So where's that smug Linux dude?

[Anonymous Coward]

But whenever anything bad ever happens on a Windows machine, it's always Windows' fault and never that of badly written 3rd party software/lack of updates/prolific amount of installed malware/malfunctioning hardware/user incompentence.

Why does Linux always seem to get a free pass?

Re:So where's that smug Linux dude?

[Anonymous Coward]

"What a shitshow...

And he got modded up for it.

I wonder what he'd have to say to Chris Evans.

Language!

Re:So where's that smug Linux dude?

[ilguido]

They're usually installed through the ubuntu-restricted-addons package.

Re:So where's that smug Linux dude?

[ninthbit]

Because how long do you think this will take to get patched on Linux vs Windows. An obscure library that may not be installed by default. I haven't checked, but I'd guess the package has already been updated.

MS on the other hand, first needs to decide that this obscure vulnerability is something to be worried about. If it's an optional feature, then they probably won't worry. And even if they do, will they release an immediate update, or will it go through a lengthy testing process and be left pending until the next round of rolled up patches.

Linux gets a pass because it's free, the community is quick to respond, and usually the disclosure includes the required patch to fix the problem. So even if you're on an unsupported built from scratch system, you could patch the problem yourself... immediately.

Re:So where's that smug Linux dude?

[Anonymous Coward]

When the story about problems with a Win10 update was posted, some insufferable twat of a Linux user posted a comment titled "What a shitshow...grabs popcorn".

And he got modded up for it.

Why does this upset you, and why are you complaining about it? There seem to be many people in society today who have difficulty tolerating disagreement, and who vocally complain about the disgreement, as if they are hoping to organize an opposition. (When the topics being discussed are political, these people are called "SJWs".)

For example, what if the article were about the Volkswagen emissions scandal, and a poster who dislikes German cars says "What a shitshow...grabs popcorn". Now, some slashdotters in Michigan (center of the US automotive industry) might also dislike German cars, and mod his post up. What's wrong with this? As far as I can tell, nothing. He is stating an opinion and some people agree with him.

In summary, your attempt to convince me to join your thread against Windows-haters has failed, and I'm surprised that you would be so petty and intolerant to even attempt starting such a thread.

(By the way, I'm a BSD user. I dislike both Windows and Linux!)

Re:So where's that smug Linux dude?

[Anonymous Coward]

given the speed of linux 5-13 years

Re:So where's that smug Linux dude?

[houstonbofh]

"usually not installed by default in Linux distros" Really?

The Vanilla Ubuntu 16.04.1 desktop image I have at hand shows that it they are installed by default:

Did you check that box during install to install additional codecs that is unchecked by default?

Re:So where's that smug Linux dude?

[passionplay]

And who runs Ubuntu? Canonical. Go report it to them.

Re:So where's that smug Linux dude?

[phayes]

Good catch! I did indeed install the restricted addons but unless I'm mistaken, thats because the installer prompts that they are needed to have the MP3 decoder.

Re:So where's that smug Linux dude?

[Immerman]

Yeah, I finally upgraded my gaming machine from win7 for the newer direct3d libraries, but only after having resigned myself to the fact that most of the worst Orwellian aspects had been backported to 7 anyway.

I have to say though that, despite all the grief it gets, I actually like the new start menu better. *F* the live tiles, but you can use the same space to create a "desktop" of neatly organized shortcuts, leaving your actual desktop as a workspace for the data files that inevitably accumulate anyway.

Re:So where's that smug Linux dude?

[Anonymous Coward]

So it wasn't installed by default, and you added it, a non-default option?

Re: So where's that smug Linux dude?

[Anonymous Coward]

Wah! I need my safe space. /sarcasm

The education system is accelerating this type of behavior.

Re:So where's that smug Linux dude?

[Anonymous Coward]

Considering the number of patches Windows needs every month it's always been a shitshow. The number of 0days for Windows will always be exponentially greater than Linux because Windows is a shitshow.

Re:So where's that smug Linux dude?

[Carewolf]

still smug I fear, he didn't install the bad plugins...

Or use Chrome..
Or GNOME

All three are required for the exploit

Re:So where's that smug Linux dude?

[hyades1]

All good points.

I think I've got 7 locked down pretty well, and I think it will stay that way as long as I'm reasonably vigilant. I don't know if I could be so sure about 10.

Re:So where's that smug Linux dude?

[hyades1]

Oh, look...some bumhurt Linux creep modded me down for simply reporting on the actions of another Linux creep.

Linux could have been the OS of choice if it hadn't been bogged down by so many a-holes.

Re:So where's that smug Linux dude?

[Raenex]

Good catch! I did indeed install the restricted addons but unless I'm mistaken, thats because the installer prompts that they are needed to have the MP3 decoder.

That seems to be the case:

"Ubuntu Restricted Extras is a software package for the computer operating system Ubuntu that allows the user to install essential software which is not already included due to legal or copyright reasons. It is a meta-package that installs: Support for MP3 and unencrypted DVD playback. Microsoft TrueType core fonts."

And ubuntu-restricted-extras depends on ubuntu-restricted-addons as well as recommending gstreamer0.10-plugins-bad-multiverse.

Web browser virtualization

[Artem S. Tashkinov]

I've been thinking about this issue for quite some time already, and I'm gonna ask it again, how do you virtualize your web browser (actually it's the only way to be fully protected against local root (kernel/system daemons) vulnerabilities, keyloggers, data theft, etc.)? Here are my minimum requirements:

• Kernel syscalls protection and user account protection - i.e. web browser must be fully virtualized
• Decent performance and 2D acceleration
• Ability to use a shared folder (for downloads and stuff)
• Ability to easily update your web browser and virtualized environment
• Lightweight!
• Audio output

Nice to have things

• Ability to use your microphone
• Decent video playback speed for video web hostings (youtube/vimeo/etc.)

Things that come to mind:

• Full virtualization via VirtualBox/VMWare Player + some OS: it's unclear how much RAM I should allocate to the guest OS and also I'm not sure 2D acceleration will work
• Various KVM/Linux containers based solutions: I suspect there'll be no 2D acceleration whatsoever and video playback speed will be awful.

So, have you got any solutions? ideas? proposals? Something working? Please share.

Re:Web browser virtualization

[AlphaBro]

actually it's the only way to be fully protected against local root (kernel/system daemons) vulnerabilities, keyloggers, data theft, etc.

I'm not entirely sure about the scope of what you're claiming here, but know that virtual machine escapes aren't uncommon. I'm not saying that virtualizing the browser is a bad idea (defense in depth and all that), but it won't get you perfect security. Also, in some cases, it's possible to attack the host OS without leaving the VM. Then there's the sensitive information within the VM (user credentials, session cookies, etc.), which doesn't require an escape.

Re:Web browser virtualization

[Anonymous Coward]

Doesn't Chrome already run in a sandbox? In this case, the faulty part is the "Audio output", which might lead to your specification having exactly the same vulnerability.

Re:Web browser virtualization

[Artem S. Tashkinov]

but know that virtual machine escapes aren't uncommon

For my entire life I've heard of maybe 10 cases of exploits which actually allowed to escape VM while at the same time each popular web browser (IE, Firefox, Chrome, Opera, Safari) has already had at least 300 remotely exploitable vulnerabilities (close to 1500 vulnerabilities overall).

Which means that when you're running your web browser in a VM you decrease your chances of being p0wned by at least two orders of magnitude. Also, since most attacks nowadays are carried out automatically, those attacks will stop at your VM because the exploit kit will not try to break out of VM since 99.999% of users out there don't bother virtualizing their browser and also there are ways to conceal your VM.

Re:Web browser virtualization

[Anonymous Coward]

Check out 'firejail' on Linux.
I use it to route specific programs through different network interfaces, and often use it for youtube in firefox with no issues.

From the manual;
        Firejail is a SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table. Firejail can work in a SELinux or AppArmor environment, and it is integrated with Linux Control Groups.

Re: Web browser virtualization

[Anonymous Coward]

It sound like you really want qubes os, where everything is sandboxed off into security zones you define.

Re:Web browser virtualization

[myowntrueself]

but know that virtual machine escapes aren't uncommon

For my entire life I've heard of maybe 10 cases of exploits which actually allowed to escape VM while at the same time each popular web browser (IE, Firefox, Chrome, Opera, Safari) has already had at least 300 remotely exploitable vulnerabilities (close to 1500 vulnerabilities overall).

Which means that when you're running your web browser in a VM you decrease your chances of being p0wned by at least two orders of magnitude. Also, since most attacks nowadays are carried out automatically, those attacks will stop at your VM because the exploit kit will not try to break out of VM since 99.999% of users out there don't bother virtualizing their browser and also there are ways to conceal your VM.

Heres an idea.

What if you could craft the audio signal so that it exploits the audio output software/drivers in the host when played from a guest VM?

Ie you have the guest VM hooked up to output its audio through the host, not uncommon in desktop virtualisation. And its the specially crafted audio signal which carries the exploit not the specially crafted file.

Re:Web browser virtualization

[Anonymous Coward]

So, have you got any solutions? ideas? proposals? Something working? Please share.

I'm doing something like that with LXC. I run the browser in its own LXC instance, which does have access to a shared directory, video acceleration, and sound. It does not have access to my normal user files or anything outside the LXC container aside from the single shared directory.

I'd agree with others that this is not perfect security, but it is still a lot better than not doing it.

Re:Web browser virtualization

[omnichad]

Why would a keylogger need to break out of the VM to be useful? It can just log the keys on that side and be perfectly happy with what it gets.

Re:Web browser virtualization

[omnichad]

And its the specially crafted audio signal which carries the exploit

Kind of hard to have a buffer overflow in the audio signal when the entire bit space is available for audio. So then what's left? A pulsed signal, that when it hits the DAC creates RF interference that then induces current somewhere else on a chip?

I know, you can read keystrokes from 2 rooms away by pointing an antenna at a keyboard, but I can't even imagine how you do an exploit with an audio waveform.

Re:Web browser virtualization

[Anonymous Coward]

That depends, can you get the guest to configure its audio driver to submit samples at 96MHz and force the host driver to execute a little-used codepath to resample the data you're providing to a speed actually supported by the hardware like 96KHz?

Virtualization is not security

[dbIII]

Nice try, but that's not security, that's just putting it in a box designed for things other than security.
All you are going to get out of that messing about is a feeling a smugness and immunity from script kiddies who are not even trying hard.
You could try doing something actually designed for security, such as simply running the web browser as a user other than the one that owns all the files you want to keep - so a unique user for the web browser. Jails and containers/zones help too because they are designed for security unlike virtual machines on PCs.

Re:Virtualization is not security

[Anonymous Coward]

>running the web browser as a user other than the one that owns all the files you want to keep
>containers

With all the LPE's in the kernel this is not going to raise your security significantly. Besides, you would still need another Xserver instance to avoid keyloggers.

Not really anything new

[Zombie Ryushu]

The idea that Linux might or does have security vulnerabilities is not anything remotely new. I sometimes file five bug reports a day on patches for things like this dealing with Debian, Rosa, Mageia, Fedora, and Suse. I just file the bugs, its up to the Distro Maintainers to read what I post and act on them. Sometimes they mark it as invalid, a Duplicate, already fixed, or Works for me.

Other times I get a patched, or upgraded package in 24-48 hours.

If you see a CVE of something, post it to your relevant bugzilla, and not just one, always provide the CVE and a URL to where you got the CVE From if at all possible. Don't stick your head in the sand and say its not your problem. Keep in mind the world we live in today.

Re:Not really anything new

[passionplay]

He wanted his 15 minutes in the limelight. Reporting CVE would not get him that.

Re:Not really anything new

[Fly Swatter]

Completely agree. 'Security researchers' report bugs to the software authors, not to the public.

Damn, Can't Test

[Anonymous Coward]

According to Debian security this was already patched a few days ago, and unfortunately I have them updated. However, there's something that puzzles me... a Fedora and Ubuntu `versions' of the exploit...? Why?

Re:Damn, Can't Test

[Teun]

I see it in the Muon History on the 13th of December.

Wait so..

[Anonymous Coward]

It's a SNES vulnerability?

Re:Wait so..

[Bobfrankly1]

It's a SNES vulnerability?

Easily fixed: up up down down left right left right b a select

zero day?

[Xylantiel]

It sounds like these are known issues that just aren't fixed yet on some distributions. That's not a zero day.

Re:zero day?

[Anonymous Coward]

It was a zero-day when published, maybe. Every distro worth something (i.e. Debian and Ubuntu) have already patched it. I got the security updates for libgme 12 hours ago (I don't have that shit pack of "bad" plugins installed).

Re:zero day?

[JThundley]

Right, it was a 0-day when it was released... a month ago:
https://scarybeastsecurity.blo...

My Debian stable machine is safe, I'm missing that file, don't use chrome, don't use gnome file managers that attempt to preview music files. Yes 0-days are bad and can happen in Linux environments as well as any other, but there's still the lack of monoculture in Linux. Show me a windows machine that doesn't have IE installed.

WRONG!

[Anonymous Coward]

https://scarybeastsecurity.blogspot.pt/2016/11/0day-exploit-advancing-exploitation.html

"A powerful heap corruption vulnerability exists in the gstreamer decoder for the FLIC file format. Presented here is an 0day exploit for this vulnerability.
This decoder is generally present in the default install of modern Linux desktops, including Ubuntu 16.04 and Fedora 24. Gstreamer classifies its decoders as “good”, “bad” or “ugly”. Despite being quite buggy, and not being a format at all necessary on a modern desktop, the FLIC decoder is classified as “good”, almost guaranteeing its presence in default Linux installs."

confirmation here:
https://bugzilla.redhat.com/show_bug.cgi?id=1397441
gstreamer-plugins-good: Heap buffer overflow in FLIC decoder

Sheesh, I thought you guys (the parent post and the ones who upvoted) were geeks and into factual information! Oh right, this is slashdot...

LOL. Not surprising to those in the know.

[Anonymous Coward]

It's totally hilarious how shitty Linux has become. Windows is now a significantly more secure desktop OS with less zero days, less general bugs, better drivers, faster performance on more hardware, and it can even run the full Linux stack for those rare occasions you need it. What kind of a moron do you have to be to run Linux as a desktop these days?

Finally...

[Anonymous Coward]

Finally! Something that runs on Linux!

Sensationalist fearmongering and attention whoring

[Fly Swatter]

'Zero day'. 'world of hurt'.

Look everyone I found a bug! Look at me! All your machines can be mine if you just install this normally not installed software, then visit this here website!

Just file the bug and let them fix it, till then just stfu.

Free vs Proprietary

[Anonymous Coward]

It seems (one of) the underlying libraries got patched 2 days ago.

https://bitbucket.org/mpyne/game-music-emu/wiki/Home

Re:Free vs Proprietary

[Bobfrankly1]

It seems (one of) the underlying libraries got patched 2 days ago.

https://bitbucket.org/mpyne/game-music-emu/wiki/Home

I won't agree on the "free vs proprietary", but it is awesome that the people behind that project responded that quickly.

used to:

[Anonymous Coward]

download a keylogger

then send root password next time user uses it,

then uses that to install root kit
and process hider

profit

Exploits in Linux?

[Anonymous Coward]

That can't be! Linux is perfect. Linux has 100% secure. Surely, it must be the graphics driver. Or perhaps they didn't compile their kernels properly. What, you mean they don't compile their own kernels?!

The bad package is installed on CentOS

[Anonymous Coward]

I found gstreamer1-plugins-bad installed on my Centos 7.3 system. Tried erasing and found out the cheese and totem apps require it. Also, installing the multimedia group will bring the bad plugins with it.

Group: Multimedia
Group-Id: multimedia
Description: Audio/video framework common to desktops.
Mandatory Packages:
+PackageKit-gstreamer-plugin
+alsa-plugins-pulseaudio
+alsa-utils
+dvd+rw-tools
+gstreamer-plugins-bad-free
+gstreamer-plugins-good
pulseaudio
+pulseaudio-module-x11
+pulseaudio-utils
+wodim

Script Kiddie exploits game library - news at 11

[passionplay]

So let me get this straight. Someone figures out how to exploit a game emulator that has nothing to do with the Linux Desktop (gaming on an emulator is not primary functionality of Linux on the DESKTOP - read that again - DESKTOP). And now we are reporting this as a distribution failure and calling the entire Linux ecosystem as bad. Meanwhile, the plugins in question are clearly labeled as "bad" as in "use at your own risk". So what is Linux on the Desktop supposed to do? Protect you from yourself? Be "just like windows"? I would suggest that we call a spade a spade and report this as a Game Emu failure. This library exists in multiple distributions but has nothing to do with the distro itself. And if you want to protect yourself - stop downloading and clicking on damn random files - "file " is far more effective than checking the extension. Someone causes a vulnerability on a file name extension in 2016 means that we haven't trained people enough that file name extensions are not linked to file format. Let's do less hype and more work. Just my two cents. (P.S. Is this even news-worthy?)

Every anti-Linux clickbait article is the same

[LichtSpektren]

Mark my words, this is the last time I'm logging into Slashdot. It's become just anti-FOSS clickbait with Microsoft ads littered throughout.

Why do I say this? Because every time some very minor Linux vulnerability crops up -- usually ones that have not actually affected anybody (the exceptions being Heartbleed and Shellshock) -- there's some ultra-clickbaity article about how the entire Linux world is getting pwned simultaneously. Thankfully some comments showing why this is total nonsense are upvoted, but also upvoted are anti-FOSS shill posters going on some laughable and preposterous rant about how Windows has such a better security record. Examples of this behavior include the recent GRUB vulnerability, Dirty Cow, and the systemd DOS attack.

To the staff of Slashdot: your audience is primarily FOSS supporters and nerds. You are alienating them. Start vetting your articles instead of posting any random crap that gets submitted, or your days are done.

Re:Every anti-Linux clickbait article is the same

[Anonymous Coward]

Mark my words, this is the last time I'm logging into Slashdot. It's become just anti-FOSS clickbait with Microsoft ads littered throughout.

Why do I say this?

You say this because you're a German, Nazi-loving, anti-Microsoft, Linux zealot, scumbag troll who has been poisoning Slashdot for years with your garbage. You don't like some of the submissions? Fine. GTFO. Your stupidity won't be missed I can assure you.

To the staff of Slashdot: your audience is primarily FOSS supporters and nerds.

BBBZZZZZZTTTT! Wrong! But your consolation prize is a giant FUCK YOU! Since year zero, Slashdot has been for nerds of all varieties, not just FOSStards like you. The moderation system does let zealots game the system to make themselves appear to be the majority, but the reality is much different. Therefore you should start camping on Reddit or somewhere else where your bigotry is more appreciated.

Re:Every anti-Linux clickbait article is the same

[Anonymous Coward]

You are like the most prominent anti-ms troll here. Why should anyone care what you think?

Re:Every anti-Linux clickbait article is the same

[passionplay]

Now if I could just get upvoted for pointing out how pointless this whole story was..... *sigh*. I agree with you.

Re:Every anti-Linux clickbait article is the same

[passionplay]

But it's a library that doesn't give you root. So what? Every exploit on windows pretty much gives you admin.

Re:Sensationalist fearmongering and attention whor

[Bobfrankly1]

...if you just install this normally not installed software...

As has already been addressed multiple times above, the package involved is installed by default in the listed distros and more.

Just file the bug and let them fix it, till then just stfu.

How about you RTFM and understand what you're talking about, till then hush little child. Consider that the sensational title is intended to get attention on an actual threat, and past the willful ignorance of persons such as yourself.

Hoarders

[iamacat]

How did these distributions get to the state where they include 80s CPU emulator by default? For users with decent Internet connection, base install should be something like ChromeOS, with only video/audio codecs widely used at present. Then have an easy way to install extra stuff as needed. It's not only for security, stability, memory/storage use and performance is also affected by having a boatload of crap installed by default. And don't forget the amount/frequency of high priority updates.

Re:Hoarders

[Anonymous Coward]

They don't have it by default. They have gstreamer by default, and the vulnerability is in a plugin for that package. On Fedora, the third party repo "rpmfusion-free" holds it.

Re:Hoarders

[Anonymous Coward]

It is indeed quite troubling that these kitchen-sink libraries get written. They should pack these really-niche codecs somewhere else. I don't particularly need to play videos that use a codec that iD software used in the 1990s.

That being said, I use ffmpeg which is rather kitchensinky too.

This is why anti-malware protection must be...

[Anonymous Coward]

This is why anti-malware protection must be added to systemd.

Re:This is why anti-malware protection must be...

[passionplay]

Oh God no. Not another area for systemd. It's bad enough it wants to own the entire Linux world. Lennox Pottering as emperor would just be bad.

Impact?

[ilsaloving]

I glossed very quickly over the article so maybe I missed it. What is the actual *impact* of this? Privilege escalation? Crash the OS?

Just because an exploit is found doesn't necessarily mean it's a significant concern unless you can do something nasty with it.

Re:Impact?

[Anonymous Coward]

Run arbitrary code as the user. That could include downloading and running a local privilege escalation. Or it could "simply" be about scarfing up every file that looks like it contains data useful for identity theft or similar.

Wow you're really smart!

[Anonymous Coward]

Are you a wizard?

yawn, this is only local priv escation

[Anonymous Coward]

Should be fixed, but requires user action to work. Not a big deal.

Re:Sensationalist fearmongering and attention whor

[Anonymous Coward]

> , the package involved is installed by default in the listed distros and more

I don't even think the gstreamer-plugins-bad package is packaged by fedora. RPM Fusion has it.

So remove the libraries

[Anonymous Coward]

I just did a 'find /usr -iname libgme*' and removed them from the system until this is fixed.

Re:Sensationalist fearmongering and attention whor

[Guybrush_T]

Sorry, but I totally agree with the original post. The title is "Ubuntu 0day world of hurt". The reality is "Ubuntu12.04, no privilege escalation". That is not a serious issue, and even the author acknowledges it, so please hush big boy.

The main users of ubuntu 12.04 are mostly servers (so not likely to be affected) and the EOL is near anyway.

Barking up the wrong tree

[Anonymous Coward]

the trigger here is overly "helpful" Desktop Environment and web browsers.

If Chrome and Firefox didn't try to auto(!)-play every file sitting in a audio or video tag, and use Gstreamer to do so no less, this would be a non-issue.

Similarly, why are the DEs feeding every new file through Gstreamer so that they can index the content for their search "feature" (more like a waste of CPU time).

Damn it, this is all Autorun grade idiocy. Are we so hell bent on "year of the desktop" that we are repeating every mistake Micrsoft was doing back in the Win9x era?!

Re:Sensationalist fearmongering and attention whor

[Bobfrankly1]

Sorry, but I totally agree with the original post. The title is "Ubuntu 0day world of hurt". The reality is "Ubuntu12.04, no privilege escalation". That is not a serious issue, and even the author acknowledges it, so please hush big boy.

The Author said: "I like to prove that vulnerabilities are not just theoretical—that they are actually exploitable to cause real problems,"
Care to share what you're basing your perspective off of? Mr Evan's actual detail *is* a long read and I fully admit I grazed it and may have missed something.

The main users of ubuntu 12.04 are mostly servers (so not likely to be affected) and the EOL is near anyway.

I'm going to presume you meant Ubuntu 16.04, and note that you're nitpicking on one of the two distributions highlighted. Regardless of the user spread between server and desktop (that was also noted in the article), are you implying that there's not enough Ubuntu 16.04 users to matter? That because it's near EOL, a zero-day exploit doesn't matter? There's exploits happening everyday that don't require privilege escalation, yet they frequently cost companies large amounts of money and time. Your definition of "serious" leaves much to be desired.

A world of sandboxes

[Anonymous Coward]

Get used to the idea of sandboxed applications. Windows 10 will look like the bright kind on the block then.

Re:Sensationalist fearmongering and attention whor

[Fly Swatter]

Why would you draw public attention to an exploit? You report it to the software authors and give them time. Anything else is completely irresponsible.

Sure, maybe go all sensational when the software authors refuse to listen to you for several months, and machines are falling left and right, however this doesn't look to be the case. They are never given a chance before public announcement. And at least on my Fedora 23, game-music-emu is NOT installed by default.

All lies!

[Anonymous Coward]

Everyone knows that open sores is invincible! Especially anything touched by the lord and savior, Loonix Toreballs! This is all lies!

Executable code as music data

[Blaskowicz]

Remember Windows Metafile? That was a picture format that consisted of executable code (poor man's pdf or ps for Windows 3.0) and ended up being abused.
Here, a whole frigging computer is emulated and the SPC file is just raw machine code for its CPU, so that you can e.g. listen to Street Fighter II music in your winamp clone. Depending on your player perhaps, you even get a track of infinite/unknown length and the music loops indefinitely.
I find it funny and it reminds me more about the entirely banal stories of "malware escapes Java/Flash/VM/jail/container/sandbox".

Re:Script Kiddie exploits game library - news at 1

[Anonymous Coward]

DESKTOP
Seriously, I've never really run an emulator on something other than a desktop. Historically there were no other options, then you could only either use a desktop or a hacked console, then there were commercial emulated games (from Nintendo on the Wii) and then mobile toys. Have fun buying stands, dongles, bluetooth controllers for your Android 4.0 phone with cracked screen. Play a 4:3 game on a tiny wide screen, with higher input latency. Great, I know that plugging a controller into a desktop's USB plug is too easy and not expensive enough, I shall not do it again and I hope this will please you.

Re:Script Kiddie exploits game library - news at 1

[passionplay]

The issue is that it is listed as a DESKTOP failure while it is truly a Game Emulator failure. It's not where you run it - it's who you gonna call. The Desktop folks can't do anything about it. Neither can the distro. It's gotta be the Game Emulator folks. Bludgeoning the top level only works in the commercial space. Here the distributions have already labelled it as a bad plug-in as a warning. There is nothing more that can be done.

Bad, but no zero days

[allo]

Zero day means, that they are used to exploit people in the wild, not that there exists an proof of concept.