Slashdot Mirror
New SystemD Vulnerability Discovered (theregister.co.uk)
The Register reports that a new security bug in systemd "can be exploited over the network to, at best, potentially crash a vulnerable Linux machine, or, at worst, execute malicious code on the box" by a malicious host on the same network segment as the victim. According to one Red Hat security engineer, "An attacker could exploit this via malicious DHCP server to corrupt heap memory on client machines, resulting in a denial of service or potential code execution." According to the bug description, systemd-networkd "contains a DHCPv6 client which is written from scratch and can be spawned automatically on managed interfaces when IPv6 router advertisements are received."
OneHundredAndTen shared this article from the Register: In addition to Ubuntu and Red Hat Enterprise Linux, systemd has been adopted as a service manager for Debian, Fedora, CoreOS, Mint, and SUSE Linux Enterprise Server. We're told RHEL 7, at least, does not use the vulnerable component by default.
Systemd creator Leonard Poettering has already published a security fix for the vulnerable component -- this should be weaving its way into distros as we type. If you run a systemd-based Linux system, and rely on systemd-networkd, update your operating system as soon as you can to pick up the fix when available and as necessary.
OneHundredAndTen shared this article from the Register: In addition to Ubuntu and Red Hat Enterprise Linux, systemd has been adopted as a service manager for Debian, Fedora, CoreOS, Mint, and SUSE Linux Enterprise Server. We're told RHEL 7, at least, does not use the vulnerable component by default.
Systemd creator Leonard Poettering has already published a security fix for the vulnerable component -- this should be weaving its way into distros as we type. If you run a systemd-based Linux system, and rely on systemd-networkd, update your operating system as soon as you can to pick up the fix when available and as necessary.
This is what happens when you reinvent everything you possible can, just 'cuz' but to put the icing on the cake, you run everything as root when you do it...
This is the tip of the iceburg as more spaghetti code will be found. Tell me again why a startup manager also does DNS resolution?
Only the State obtains its revenue by coercion. - Murray Rothbard
Slackware does not use systemd and therefore is not affected by this vulnerability.
At least in this case, the KISS philosophy paid well.
-- Look to the Rose that blows about us--"Lo, Laughing," she says, "into the World I blow..."
Goes back to working on some FreeBSD vms.
http://saveie6.com/
When was the last time Linux was said virus free and the best secure system ??
IT seems a lot of people are making bla tant effort to corrupt it in every way possible
one more reason to run Devuan!
I am not sure I'd consider this much of a problem. Yeah, it's a UNIX pitfall, but "rm -rf /foo/.*" will work the exact same way, no?
tmpfiles: R! /dir/.* destroys root
Yes, as you found out "0day" is not a valid username. I wonder which tool permitted you to create it in the first place. Note that not permitting numeric first characters is done on purpose: to avoid ambiguities between numeric UID and textual user names.
So, yeah, I don't think there's anything to fix in systemd here. I understand this is annoying, but still: the username is clearly not valid.
systemd can't handle the process previlege that belongs to user name startswith number, such as 0day
I tested Ubuntu, Debian, FreeBSD, and OpenSolaris, 0day is a perfectly valid username.
How did anyone that lacked that much understanding about UNIX get in charge of the init system?
when you pry it out of my cold dead hands.
So glad I ditched SystemD distros for my servers....
Lawyers, MBA's, RIAA? A jedi fears not these things!
Isn't that "Lennart"?
IPv6 should be the only protocol running. Your router can transparently convert to legacy formats.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Emacs was said to be a perfectly good OS with built-in text editor.
When handling modular software, one module should do one thing and do it well, but the framework is responsible for ensuring deadlocks, crashes and security defects are confined to the module suffering them. Do that and it doesn't matter how buggy a component is, there's no contagion.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I was turned off by systemD and the direction Linux distros taking by adopting it as it seems a departure from the Unix philosophy. I was also turned off by the restrictive communication/behaviour rules forced upon the FreeBSD community. So I decided to give OpenBSD a shot and was pleasantly surprised. You can perform a lot of server functions with just the base system, working with it is intuitive, and it's surprisingly up-to-date.
Won't fix. Just like all other systemd bugs.
... and a certain narrow-moustached Chaplin template, but let's not get there.
It seems that when you are really really batshit insane and yet just as batshit over-confident, people bug out, and they start taking you seriously, because they can't believe that somebody that confident can be that nuts. Or it makes their heads explode. Just like the Chewbacca defense...
"Look at the monkey! Look at the silly monkey! *head explodes* -- South Park, S02E14 "Chef Aid"
Also systemd is evil and inherently insecure.
The kernel still can't handle shebangs with spaces in the interpreter's path.
Yet every common unix fs has allowed spaces in filenames for decades...
IPv6 is a security nightmare. Nobody should run it. We need something better to replace IPv4.
It's not re-inventing that they keep doing.
It's laziness.
"Why do I have to READ someone ELSE's manual and learn some large API I can't easily understand... when I could do something FUN like parse XML's using regular expressions!"
If your measure for quality is the amount spent to design it and the number of customers, you must love Windows 10.
I hope you go out of business before you fuck Linux up even more.
I find that I cannot do that anymore, conscionably. Sadly, it would seem that security is as bad or worse than competitors, and best practices have been thrown away in favor of rapid release cycles and whiz-bang, bleeding-edge bullshit. They may have attracted new fans, but old supporters are going to be obliged to switch to something else... perhaps a BSD variant.
Our reign has gone on long enough. Indeed. Summon the meteors.
Alternatively, I can still just give the finger to IPv6 and block it completely and be rid of the complexity it brings. Yes, I have several static IPv4 addresses.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
How is it a security nightmare? It's simpler and more secure. I should know, I was one of the earliest adopters.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Unauthenticated network reconfiguration? Calling it more secure is laughable.
There is no extra complexity.
Fields are properly aligned and have fixed meaning, making processing easier.
Routing is strictly hierarchical, so only four bytes need ever be examined - same as IPv4.
The header has a much simpler structure.
Addresses are (protocol):(location):(unique identifier). How much simpler can you get? Technically, all you have is the identifier, which you can take between ISPs that have IPv6 correctly configured. This guarantees mobility between ISPs without losing connection.
Configuring an IPv6 network? Radvd works fine. Don't need DHCP just DDNS. That's less complexity.
Address length? Who cares, it's only visible in misconfigured networks. Besides, because of the way it is composed and because of the express mobility, a full address doesn't mean anything except for fixed servers.
Correctly-configured IPv6 suffers no fragmentation, simplifying firewalls. It supports misconfigured systems, because admins are lazy, but you don't need stateful firewalls in IPv6.
Addresses are transient, only names are permanent, which means only machines deal with addresses.
Router protocols are simpler under IPv6 because the design is simpler. Latency is reduced, too.
Because the prefix identifies protocols, your stack doesn't need to check if you're in the unicast or multicast range, it checks one byte against a case statement.
Any options in the IPv4 header that were rarely used got moved to option headers. This means you've a modular design (cleaner), you don't need to process information you probably aren't going to use, and you can often ignore the extra headers anyway. Even if you don't, it invites cleaner, simpler, code.
Sorry, whoever told you IPv6 was more complex was full of it.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I should add I've also several static IPv4 addresses, but also several IPv6 addresses since 1996. Please play again.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
If you have IPv6 correctly installed, all reconfiguration is strongly authenticated.
If you don't have it correctly installed, sounding like a defeated Joker won't fix your problems.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
It has been done to avoid all of this.
Support and donate, otherwise the systemd cancer will kill Linux
This was the plan all along
Do Android and iOS use SystemD? Google and Apple should let us know.
Is Microsoft Windows vulnerable to the same type of exploit? Someone qualified to answer this should let us know.
you should really go back to using slate and chalk.
"The hands that help are better far than lips that pray." - Robert Ingersoll (1833-1899)
If that is your level of insight, I should probably give you the finger as well....
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I don’t get one thing. Pottering is obviously is challenged when it comes to writing defensive code, listening to others, etc. How on earth did he get so major Linux distro maintainers convinced of systemd? One subpar human shouldn’t have been able to dupe so many. Anyone got an explanation for that?
Different AC here, jiust pointing out that you failed to carry the argument when you called IPv6 simpler. Nobody, and I mean absolutely nobody, believes this, you lost your audience. I'd also note that any protocol that is insecure and only secure when configured "just so", and relies on the No True Scotsman security defense has failed as a standard.
All code has bugs. But the bigger, more complex the code is, the more likely it is to have bugs. And why re-invent the wheel just to have a "newer, shinier" wheel?
If you want systemd, just install Microsoft Windows instead. As an added "benefit", Windows also has a lot of vulnerabilities so systemd users will feel right at home.
True Fact: SystemD is full of AIDS and FAIL. ([NO citation needed])
Stop shoving systemd down our throats.
There is a very good reason to rewrite the stack. It puts RedHat in charge of it. In fact, they could even take their entire stack proprietary with a fork. Then every distro that relies upon their stack would be screwed.
Great business decision!
Only the utterly dumb equal "newer" with "better"...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Why do we keep spelling "systemd" as "SystemD"? I don't get it. If we want to capitalize the first letter, ok, but then it's "Systemd". Otherwise, we should start writing "HttpD", "BinD", "SshD", "LpD" or "InetD" for other well-known Unix daemons.
Official source: https://www.freedesktop.org/wiki/Software/systemd/#spelling
This is the tip of the iceburg as more spaghetti code will be found. Tell me again why a startup manager also does DNS resolution?
I've been in software QA since '93 and a *nix user just as long... here's where there is real danger in systemd. Because the more complex, intertwined, and less elegant the codebase, the more likely fixing bugs will introduce or uncover more. People have always ignored this aspect of the *nix philosophy, or rather maybe just inherently understood it. I don't know how many times over the years I have seen a bugfix cause havoc in a monolithic spaghetti codebase. Then of course, you try to quickly fix those "new" bugs, which also causes issues you may or may not find immediately.
Phrases like "it's a one line code change" or "it should just flow right through" or "you don't need to test that, this fix won't affect it" always put me on alert.
I'm not saying the sky is falling for systemd. I'm just saying that there should be a fallback option to it, and there is not. Considering the staggering number of servers running Linux in the world, it's simply a risk that should be considered.
My beliefs do not require that you agree with them.
I was reading through the discussion on the Debian bug site and Martin has some crazy ideas. He thinks that eventually the default mail router should be gmail and that /etc/resolv.conf will be removed.
We take pride in our work. Pottering is a professional, paid by Redhat.
If your measure for quality is the amount spent to design it and the number of customers, you must love Windows 10.
And the illiterate-fucking idiot makes a desperate attempt to use irrelevant "what-about-ism" to its defense.
This is one of the things that drives me nuts about IPv6 proponents. They go all crazy defensive if you criticize anything about their protocol, even when the criticism is fair. I haven't seen anything from you that isn't fair and I have seen the opposite from jd.
It's a fact that IPv6 is much more complicated than IPv4.I would have just made a new protocol that corrected IPv4's mistakes, addresses would be 64bit long and used CIDR notation. Broadcast would have been kept since it's stupid simple to use the last address, with all FF's for the MAC. DHCP would still exist and would be the main way for a dynamic addresses would be assigned Dhcpv6 has a cool feature, a router can request to get a routable subnet.
IPv6 has two main mistakes. Trying to do too much for the layer it is in the network stack, and not learning from past mistakes.
But but he was an early adopter. LUL.
This is one of the things that drives me nuts about IPv6 proponents. They go all crazy defensive if you criticize anything about their protocol, even when the criticism is fair. I haven't seen anything from you that isn't fair and I have seen the opposite from jd.
Thanks.
It's a fact that IPv6 is much more complicated than IPv4.I would have just made a new protocol that corrected IPv4's mistakes, addresses would be 64bit long and used CIDR notation. Broadcast would have been kept since it's stupid simple to use the last address, with all FF's for the MAC. DHCP would still exist and would be the main way for a dynamic addresses would be assigned Dhcpv6 has a cool feature, a router can request to get a routable subnet.
IPv6 has two main mistakes. Trying to do too much for the layer it is in the network stack, and not learning from past mistakes.
Indeed. Beginners mistakes. Brooks calls this "The Second System Effect". We are seeing a lot of that on the IT world.
They should basically just have extended the address range and kept everything essentially as it is with IPv4, as IPv4 is not broken.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Exactly ipv4 needed address extension and simplification. People have a hard enough time understanding VLANs and subnets. Let alone trying to figure out how to calculate how much I can works.
True, all projects have problems, but those projects usually can't affect the majority of essential projects and even in those cases having alternatives helped top mitigate impact.
Thema thing ist that a systemd vulnerability is a vulnerability in all Thema other projects using ir.
I'm atheist and don't give a damn about protocol religion.
Only thing that matters is facts. Fact is, it is simpler. The primary header has word-aligned headers with simpler semantics, and none of the semantics that complicates things about IPv4. One word does one thing and does it well.
You've offered no contradiction to this, just some mysticism. IPv6 is simpler because each piece does less and there are fewer mandatory pieces.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
How is it not CIDR?
Name a complexity added.
You claim he's being reasonable but all I see is hand-waving, abuse and mysticism. Offer something solid or admit you can't.
I use the protocol. I use both. I have experience where all you offer is allegation. You want me to take you seriously? Offer a reason for your claim. A real reason.
Extended IPv4 was rejected for many good reasons. You never bothered to look them up, I see. I tend to listen to those who bother. Even if I disagree, I'll listen to those who bother.
Bit aligned fields are not simple.
Fragmentation is not simple.
IPv4 multicast is complicated.
IPv4 anycast doesn't exist.
IPv4 MobileIP is complicated.
IPv4 DHCP is complicated, insecure and unreliable.
IPv4 routing is slow and memory hungry.
These are reasons.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I don't think you are quipped to understand my reasons. Sorry, KISS is for advanced players only. And no, experience does not make you an advanced player, what you learn from experience may or may not make you one. Hence I will not waste time on this and you get the satisfaction to cry "But you do not have any actual arguments!" loudly. I do not really care.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
"The more they overthink the plumbing, the easier it is to stop up the drain." SystemD is undoubtedly severely overthought plumbing. I don't know why someone thought they could improve on SysVInit with start-stop-daemon, but they were quite badly mistaken.