DJB Announces 44 Security Holes In *nix Software

generationxyu writes "D. J. Bernstein, better known as DJB, has announced the discovery of 44 security holes that were found by students in his course MCS 494: Unix Security Holes this fall at the University of Illinois at Chicago. Vulnerable programs of note include: CUPS, NASM, mpg123, MPlayer, xine-lib, and numerous others. Copies of the notification emails are here. The homework for the course was to find and exploit 10 previously undiscovered security holes in currently deployed Unix software. In a class of 25, 44 security holes seems a bit low. Most of the class failed. I was credited with bsb2ppm (actually libbsb) and jpegtoavi. After 300 hours of work and an A average on the exams, I expect to fail the course."

All you need is one more hole...

[Nom du Keyboard]

After 300 hours of work and an A average on the exams, I expect to fail the course.

All you need to do is find one more hole, this one in the campus records department, and exploit it for improving your grade. If you have an "A" average otherwise, another "A" will look right in place. It's the "D" average people suddenly getting "A"s and "B"s that draw suspicion.

and the moral is:

[pchan-]

After 300 hours of work and an A average on the exams, I expect to fail the course.

but we've all learned a valuable lesson: don't take a class taught by DJB

How to pass this class (females only)

[Anonymous Coward]

Let your prof 'secure' your hole, if you know what I mean.

Hmm...

[excaliber19]

Perhaps Microsoft should try this strategy. Im sure the kids would thoroughly enjoy that assignment! They'd have bugs coming out the wazoo! A's for everyone!

Where's the gumpf?

[caluml]

Hey! I've found remote roots in OpenSSH, Apache, and Bind. If you run the file below, you can get root.

[ Part 2, Text/PLAIN (charset: unknown-8bit) 95 lines. ]
[ Unable to print this part. ]

But you have already found 10 bugs!!!

[jgbustos]

Why take for granted that the number of bugs to be found was expressed in base-10? Why not base-2?

Re:Don't just take this lying down, IMO

[Saint Stephen]

My algorithms class was like this. I aced every test but didn't complete the Travelling Salesman program successfully. I got an "incomplete" and had to come to summer school. Boy was I mad at the time but I see now why they did it. All or nothing.

Re:Don't just take this lying down, IMO

[bani]

you really think djb cares? given his well known history of being supreme asshole of the known universe?

fwiw this was obviously djb trying to get his students to dig up ammo for him to go on another one of his public penis-waving tantrums, acting all smug and high and mighty again (oh lookit me i wrote qmail and its all uber secure, and wooo lookit all the MISERABLE LAMERS WRITING SHIT CODE!!1!!111!)

Re:Most people will pass

[wk633]

D.L. Parnas once taught a 300 level software engineering class at the University of Victoria.

Grading used the 'high tide' method. That is, better score in one area of the course (exam, project, assignments) could override a poor score in another area. All instructor's judgement.

One student I knew got a C+ and discovered that he had roughly the same scores in each area as another student who got an A. That is, guy I knew had a poor exam, but awesome project. Someone else had nearly identical exam scores, and nearly the same (A) project.

So guy-I-knew approached Parnas, and asked why.

"Becuase I don't like you".

And that was the end of it.

Re:ah, buffer overflows...

[symbolic]

If you can always remember to wipe your butt, you can always remembers to watch your buffer lengths.

Well, there's the problem!

Re:But you have already found 10 bugs!!!

[addaon]

base-10 is base-2. Or did you mean base-1010?

10 types of people ...

[fuufump]

The homework for the course was to find and exploit 10 previously undiscovered security holes in currently deployed Unix software.

"There are only 10 types of people in the world: Those who understand binary, and those who don't"

Re:Misleading Title

[Cuthalion]

Have you actually tried removing notepad?

Windows tries pretty hard to keep you from doing so.

only need one exploit

[abaybas]

No need to find 10, just find one and then hack into the prof's grading machine. there.

Re:Agreed, many profs are abusive

[commodoresloat]

Its no coincidence many sleep with their students, its often the only way they can get laid.

This is false.

We sleep with our students because they're just so damn sexy in their cute little spring wardrobes.

(I'm joking, I'm joking; stop slapping me with that trout already!)

How can you fail with open source??

[wfberg]

1) Create sourceforge project page under assumed name.
2) Post forks of programs with extra bugs inserted.
3) Profit!

You see - there's a number 2 step, thanks to open source.

Re:Don't just take this lying down, IMO

[Chandon Seldon]

The traveling salesman problem is easy.

For 1 city, you're already done.
For 2 cities, you start in one and go to the other.
For three cities, you find the two cities furthest from eachother, travel from one of them to the middle city and then to the far city.

Obviously it's no more complex for (any-value-of-N) cities.

Re:Agreed, many profs are abusive

[corbettw]

We sleep with our students because they're just so damn sexy in their cute little spring wardrobes.

The scary thing is, you're a kindergarten teacher!

Duh!

[Quixote]

I'd fail these students too. Clearly they hadn't heard of DJB and his attitude to sign up for his course. With such a gaping hole in their knowledge, they deserve to get an F.

Re:If the majority of the class failed...

[mph]

If the majority of the class failed, then the professor failed YOU.

You forgot the "In Soviet Russia" part.

Re:Don't just take this lying down, IMO

[he-sk]

Come to Germany!

Wait, to late.

Re:Don't just take this lying down, IMO

[myowntrueself]

and my entire class was failed because noone could write a program to check whether another, arbitrary program, would eventually finish execution...

Re:Misleading "Exploits" (Was Re:Misleading Title)

[YrWrstNtmr]

1. Somebody emails you a file
2 You, apparently without ever looking at it, run that file through something like jpeg2avi or nasm
3 Gasp! You've been 0wned!

Which is precisely how many Win boxes get compromised.

Re:Misleading Title

[Tanktalus]

Um, because it's what most Windows users spend most of their time with? :-)

Re:Don't just take this lying down, IMO

[Anonymous Coward]

I don't understand why Professor Gödel assigned that problem. I'm sure Professor Turing wouldn't have.

Re:Good idea?

[squidfood]

We all already failed the course :-)

Of course you failed. Obviously, half of you were supposed to rapidly deploy buggy software via sourceforge while the other half "fixed" the problems. Or don't you know more about Dilbert than us professionals? :)

Re:Don't just take this lying down, IMO

[Tanktalus]

#include <sys/types.h>
#include <signal.h>
#include <stdio.h>

int main(int argc, char** argv)
{
pid_t p = atol(argv[1]);
kill(p, SIGKILL);
printf("Process %d ran in 0 time.\n", p);

return 0;
}

Or something like that.

Re:Misleading Title

[Chris Burke]

Ahh, this is such stuff that pointless flamewars are made on.

No it isn't, you moron!

Re:Good luck with that one....

[Schnarl]

All other classes are inferior and a waste of resources compared to DJB's class! Oh by the way, his class will only be held in the western area of the quad in a specially built room with circular windows for optimal lighting.

At least the assignment wasn't....

[mysidia]

For each student to find two new security bugs in Qmail.

Re:I can see it now...

[Fulcrum of Evil]

I wouldn't say that to DJB. He'd probably pull out 20 or 30.

I doubt it - sendmail doesn't count.

Re:Agreed, many profs are abusive

[Anonymous Coward]

And you have never seen a female use tears to play on someones emotions and get their own way?

I was once naiive like you.

And I was once bitter like you.

Re:It's just an assignment - Did you even go to un

[SetupWeasel]

Today is a red-letter day!

No matter how incidentally or innaccurately, I was favorably compaired to Neils Bohr.

JUST for future reference

[veg_all]

No- I don't think djb cares per say

Not to be an asshole, but it's per se [sacklunch.net]

Re:Good idea?

[russotto]

If you'd been really clever, you'd have written some software -- preferably a whole suite of trivial related items, posted it somewhere, then "found" all the holes you put in them :-)

Re:Varying levels of seriousness...

[hey]

Oh great, I'm looking forward to that.
***!!!Error you are using the standard libary!!!!***
Switch to the much better Win32 API or we'll tell your boss you are using something portable.