Forgot your password?
typodupeerror
Security Bug Software Linux

Major Security Hole In Samsung Linux Drivers 295

Posted by kdawson
from the drive-a-truck-through dept.
GerbilSoft writes with news of a major security hole in Samsung's proprietary Linux printer drivers. From the Ubuntu Forums: "Just to inform you about a recent post on the French Ubuntu forum about Samsung drivers (sorry, in French). [Google translation here.] It appears that Samsung unified drivers change rights on some parts of the system: After installing the drivers, applications may launch using root rights, without asking any password. What is more, you may be able to kill your system, by deleting system components, generally modifiable only by using sudo." GerbilSoft adds: "Among the programs that it sets as setuid-root are OpenOffice, xsane, and xscanimage."
This discussion has been archived. No new comments can be posted.

Major Security Hole In Samsung Linux Drivers

Comments Filter:
  • Lazy Design... (Score:5, Insightful)

    by Azuma Hazuki (955769) on Wednesday July 18, 2007 @06:57AM (#19898995)
    This sounds like a cheap hack. There is no need for these things to be setuid root, not on the program level. Sounds like someone is used to programming Windows drivers...

    I'm tempted to infer something sinister about this, but then I remember the old adage "never attribute to malice what can be explained by stupidity." It keeps your blood pressure nice and low.
    • Flawed Design... (Score:2, Informative)

      by krischik (781389)
      Only when the little bugger of an hotplug-manager changes the user id for the scanner device to the logged on user. Which still only gives one user access to the scanner. Have my Wife remote logged in and only one of us can use the scanner.

      Unix security if just flawed and the flaw is called "root".

      Martin
      • Re: (Score:2, Informative)

        by Anonymous Coward
        Maybe you should turn off the hotplug manager, or reconfigure it so it doesn't manage your scanner device? Why not set the scanner device to be owned by a group consisting of yourself and your wife? Then you could both use it, and neither of you would need to be root, and you wouldn't need any setuid binaries.
      • Re:Flawed Design... (Score:5, Informative)

        by morgan_greywolf (835522) on Wednesday July 18, 2007 @07:42AM (#19899359) Homepage Journal
        I'm going to reply to your post backwards, but you'll see why.

        Unix security if just flawed and the flaw is called "root".


        There is a fix for this flaw. It's called 'groups.'

        Only when the little bugger of an hotplug-manager changes the user id for the scanner device to the logged on user. Which still only gives one user access to the scanner. Have my Wife remote logged in and only one of us can use the scanner.


        This is distro-dependant. On Ubuntu, scanner access is controlled by groups. Want a user to be able to scan? You add them to the scanner group. You want someone to have access to burn CDs/DVDs? You add them to the cdrom group. If the scanner device is owned by any user, and owned by the group scanner, the permissions on the scanning device are set to group read/write, and both you and your wife are in the scanner group, then you both have access to the scanner. Try it yourself. Problem solved.

        BTW--with SANE, the best way to have two people access the same scanner is via the saned network sharing mechanism, which allows other systems using xsane (or other sane front-end) to access the scanner over the network without having to remote login.
        • Re: (Score:2, Redundant)

          by drsmithy (35869)

          There is a fix for this flaw. It's called 'groups.'

          Groups don't fix the flaw of a superuser. Not only are groups the wrong ballpark to do so, they're not even playing the same game.

          • by GooberToo (74388) on Wednesday July 18, 2007 @08:30AM (#19899889)
            Which is why most distros support POSIX ACLs...they are just not widely used. Ext2, Ext3, JFS, XFS, and ReiserFS all support ACLs (extended attributes). I believe NFS version 3 and 4 also support ACLs.

            There are of course some other areas which ACL's don't address but there are pre-existing mechanisms to address those as well. Well, on most modern Unix/Linux systems anyways. The model has survived for so long for simple reasons; it's effective, simple and covers the vast majority of situations. When complex requirements come into light, more complex solutions exist. Most people just don't know about them.

            • Re: (Score:3, Interesting)

              by mgpeter (132079)

              Which is why most distros support POSIX ACLs...they are just not widely used. Ext2, Ext3, JFS, XFS, and ReiserFS all support ACLs (extended attributes). I believe NFS version 3 and 4 also support ACLs. why most distros support POSIX ACLs...they are just not widely used. Ext2, Ext3, JFS, XFS, and ReiserFS all support ACLs (extended attributes). I believe NFS version 3 and 4 also support ACLs.

              True, but until most GNU/Linux applications fully support ACLs, I highly recommend not using them and sticking wit

          • Re: (Score:3, Interesting)

            by MyIS (834233)

            The GGP post was citing the scanner situation as evidence for the "flaw of the superuser". The GP post explained why that evidence is not applicable, as it is solvable with standard practices of any well-managed distro. There is little point in saying that "groups don't fix the flaw of a superuser", since the GP explained exactly how groups *do* fix at least part of that "flaw".

            Personally, I think that standard Unix security model is complicated enough as it is without using ACLs. Not to say that ACLs are

        • Re: (Score:3, Interesting)

          by DrSkwid (118965)
          Root is a design fault.

          That's why the inventors of Unix took it back out again when they did their next OS [bell-labs.com]

          btw. it's dependent
      • by cortana (588495)
        Perhaps you should upgrade to a distro that is designed for use by multiple users:

        $ lsusb -s 005:004
        Bus 005 Device 004: ID 04a9:221c Canon, Inc.
         
        $ ls -l /dev/bus/usb/005/004
        crw-rw-r-- 1 root scanner 189, 515 2007-07-18 13:59 /dev/bus/usb/005/004
        On Debian (and derived) systems this is done by udev.
    • by jkrise (535370)
      My thoughts exactly. Although, given Slashdot's tendency to sensationalise things (remember the JRE bug that could make everything vulnerable?) it could be a while before we can get to the truth of the matter.

      The key qn. is:

      Were these programs given elevated privileges in order for the Samsung device to work?
      OR
      The driver elevated privileges of programs unrelated to it's functioning.

      If the latter is true, then Samsung needs to be conngratulated for highlighting the pitfalls of closed source drivers in Linux.
      • Re:Lazy Design... (Score:4, Informative)

        by B'Trey (111263) on Wednesday July 18, 2007 @08:01AM (#19899579)
        I can't tell you why the driver did what it did. However, from what I've read, the driver actually moves binaries to new locations and replaces them with a startup script which is set to run suid. That's way, way, way over the line. It breaks lots of stuff, like updates and patches. Someone doesn't deserver to be fired. Someone deserves to be tarred and feathered and banned from ever touching a computer again.
    • Re:Lazy Design... (Score:4, Insightful)

      by EveryNickIsTaken (1054794) on Wednesday July 18, 2007 @07:45AM (#19899383)

      Sounds like someone is used to programming Windows drivers...
      No, it merely confirms that there are lazy programmers creating crap code for all OSes, including Linux.
    • I deal with this kind of crap in embedded Linux installs daily. Managers and marketoids want to do all sorts of insanely stupid things under the guise of "making it easy for the customer to configure the device within a maximum of 5 minutes with no technical knowledge", etc.

      In the mean time the fallout from all the insane things that "need" to be done is gaping security holes all over the place and a bunch of manager types saying 'but it doesn't matter, nobody will ever want to hack us'.

      For the record I us
    • Re:Lazy Design... (Score:5, Interesting)

      by a.d.trick (894813) on Wednesday July 18, 2007 @09:25AM (#19900663) Homepage
      I think lazy is pretty generous. Putting setuid root on something as powerful as openoffice is flat-out retarded, period. These guys are driver writers, they should know better than this. I mean they, really ought to know better than this. It would be like Red hat dumping ssh and recommending telnet for remote shell access and transfer of sensitive information.

      I don't see any reason to think something malicious of it, but I think this goes beyond stupidity. It's not quite as bad as distributing rootkits with your CDs, but I think it's getting there.
    • Re:Lazy Design... (Score:4, Insightful)

      by Liquidrage (640463) on Wednesday July 18, 2007 @09:55AM (#19901121)
      A potential flaw in a linux driver from Samsung is blamed on MS, in 2 different manners no less, and it jets to +5.

      Classic /.
  • It seems extremely dangerous that a user can install something like that, with that kind of effects. Very insecure indeed. Can anyone explain why in the whole world something like this could ever happen, or is in fact an exploit/virus/worm?
    • by Xiph (723935) on Wednesday July 18, 2007 @07:06AM (#19899069)
      It's a driver installation, so the ordinary user doesn't/can't do it.

      However, it's a proprietary driver, that you need to install to use the printer, so if that's the printer you have people install it, expecting it not to create security holes.
      This might have been discovered earlier, if it weren't for the closedness of the source.

      My guess is that it happened due to a coder writing the driver so, it requires root to use it.
      Then trying to guess which programs requires the driver, then setting those to run as root. Silly, but easy to do.

      Sounds like it was done without peer review, so i guess they only have one guy writing their linux drivers..
      So why is it proprietary? well some places printers are encouraged(required) by law (enforcement) to leave secret and invisible watermarks.
      If it isn't done in the printer, it's done in the driver, if it's open, it'll be removed.
      • Re: (Score:3, Insightful)

        by plague3106 (71849)
        This might have been discovered earlier, if it weren't for the closedness of the source.

        Really? It could not have been detected by noticing that OpenOffice is not SetUID? I believe there is even a package for linux that monitors binaries in /bin, /usr, etc. and notifies you immediately if permissions have changed for anything. I know such a package was available for RedHat when I was using that. That could not have detected this sooner?

        Stop with your lame "thousand eyes" theory. Apparently those thousan
        • Re: (Score:2, Insightful)

          by Anonymous Coward
          Stop with your lame "thousand eyes" theory. Apparently those thousand eyes couldn't see a permissions change on their own systems.

          But it's been seen. Is that then proof of the thousand eyes theory?

          (you fucking idiot)
        • Stop with your lame "thousand eyes" theory. Apparently those thousand eyes couldn't see a permissions change on their own systems.

          Apparently someone did... else we would not be reading this story.

          • by plague3106 (71849)
            Yes, eventually, but not as the OP claimed with This might have been discovered earlier.
            • Yes, eventually, but not as the OP claimed with This might have been discovered earlier.

              Actually, 'chmod' calls do tend to stand out. Anyone doing a security review of source code (and drivers do get that kind of attention) would note them.

              I think one of the reasons this took a while to find is that it's so monumentally moronic no one would have believed anyone would actually try that. I'm still a bit dumbfounded, myself.

        • I agree, BUT (Score:5, Insightful)

          by PetriBORG (518266) on Wednesday July 18, 2007 @07:27AM (#19899217) Homepage
          I agree with what you said, BUT...

          Stop with your lame "thousand eyes" theory. Apparently those thousand eyes couldn't see a permissions change on their own systems.
          This is uncalled for, because as can be see on the ubuntu forums [ubuntuforums.org] you can clearly see it was the "thousand eyes" reality that caught this problem in the first place and found the solution to remove parts from the install script.

          wrap_setuid_third_party_application xsane
          wrap_setuid_third_party_application xscanimage
          wrap_setuid_ooo_application soffice
          wrap_setuid_ooo_application swriter
          wrap_setuid_ooo_application simpress
          wrap_setuid_ooo_application scalc
          And the content of the function for suid-making functions etc. So I have to disagree with you there.

          I also agree with you though that linux distros should be automatically building in some sort of tripwire type setup to protect important system segments from scripts that are like this.

          • I also agree with you though that linux distros should be automatically building in some sort of tripwire type setup to protect important system segments from scripts that are like this.

            OpenBSD emails root every night with the results of the daily insecurity check, if it finds anything. One of the things it looks for is new setuid-root binaries. If this had been OpenBSD, then it would have been caught within 24 hours of being installed. I'm surprised Linux distributions don't include something similar already.

            • by cortana (588495)
              Well, it may protect against idiots and accidents, but if someone wanted to make something setuid for malicious purposes they could just alter the cron job that does the scanning. Or fork and leave something running in the background that would change the file permissions back to what they were before the cron job runs and restore the setuid bit after it completes...
              • if someone wanted to make something setuid for malicious purposes they could just alter the cron job that does the scanning
                Unless you are running at securelevel > 0, and have the system immutable flag set on the script. In this case, even root can't modify it. Of course, your second attack would work, unless the insecurity report script was set to run with a random 0-24 hour delay at the start. This isn't done, but it seems sensible, so I might submit a patch.
            • OpenBSD emails root every night with the results of the daily insecurity check, if it finds anything. One of the things it looks for is new setuid-root binaries. If this had been OpenBSD, then it would have been caught within 24 hours of being installed. I'm surprised Linux distributions don't include something similar already.

              My experience of "things that email root every night with security checks" is that generally they trigger on so many false alarms that they are useless. Take logwatch for example - b
          • by MrNemesis (587188)
            I also agree with you though that linux distros should be automatically building in some sort of tripwire type setup to protect important system segments from scripts that are like this

            "This inst_samsng_drv.sh wants to change entries in /bin, /usr/bin and /usr/lib. Cancel or Allow?" ;)

            I'm probably in the minority of desktop Linux users who has a reasonably comprehensive log/file scanning setup; AFAICR chkrootkit and rkhunter both have checks for suid programs, and I'd love to see both of these apps installe
      • by rbanffy (584143)
        I would like to add that, had the driver writer done his/her job and made it to work the proper way (SANE for the scanner, CUPS/GhostScript for the printer) and maybe something more specific for the fax part, he would never, ever, face any problem.

        It's lame and inexcusable.
    • Re: (Score:2, Insightful)

      by PetriBORG (518266)

      It seems extremely dangerous that a user can install something like that, with that kind of effects. Very insecure indeed. Can anyone explain why in the whole world something like this could ever happen, or is in fact an exploit/virus/worm?

      It will require root privs to set up in the first place. It comes from the old UNIX method that "if you are privileged enough to have root, you should damn well know what you're doing." mindset. The problem is that apt-get, etc almost all require "root" or wheel access anyway to run. That means you're running a lot of program installers as root that probably you don't really trust enough to install in all parts of the system (see this as an example).

      • by cortana (588495)
        Only if you blindly add unaudited and untrusted third party repositories to apt's sources.list.

        This would never happen if the driver was installed from the Debian package repository, because the Debian packaging policy does not allow packages to mess with each others files in this way. :)
    • by Anonymous Coward on Wednesday July 18, 2007 @07:13AM (#19899119)
      An app running as root can do anything it wants - and installers normally do run as root. The same problem exists on every OS: the administrator and the programs he runs can do retarded things.

      The question I want to ask is why there is a driver developer working for Samsung who is able to understand the function of the setuid bit but not the security implications of using it. It seems that there is a very special type of stupidity involved here, along with some extremely thoughtless design. Samsung is taking a big risk employing morons like that.

      If the guy can't understand the security implications of the setuid bit, which are well documented and not that complex, he should not be writing software.
      • by imroy (755)

        The question I want to ask is why there is a driver developer working for Samsung who is able to understand the function of the setuid bit but not the security implications of using it. It seems that there is a very special type of stupidity involved here, along with some extremely thoughtless design. Samsung is taking a big risk employing morons like that.

        My guess: the programmer or programmers is/are more experienced with the Windows environment, where this sort of tom-foolery with permissions and privi

  • Windows coders (Score:5, Insightful)

    by erroneus (253617) on Wednesday July 18, 2007 @06:59AM (#19899011) Homepage
    If I'm not mistaken, this is how Windows got as bad as it is.

    This particular incident cannot be protested enough. If this sort of thing becomes common, End-user Linux will become as corrupted as Windows.
    • Re: (Score:2, Interesting)

      by suv4x4 (956391)
      This particular incident cannot be protested enough. If this sort of thing becomes common, End-user Linux will become as corrupted as Windows.

      Your point is, Linux is good because only select people use it for select few apps. That's why Mac is good as well.

      I suppose this is an example of a self-defeating prophecy: it's secure/stable, so use it! But if many use it, it's no longer secure/stable.
      • by jkrise (535370)
        Your point is, Linux is good because only select people use it for select few apps. That's why Mac is good as well.

        I suppose this is an example of a self-defeating prophecy: it's secure/stable, so use it! But if many use it, it's no longer secure/stable.


        Not sure why I'm feeding a troll, but he never mentioned about Linux being good for a few apps. Linux (or the Unix multi-user security system) is good enough for the entire web, provided people who write apps do so in a transparent way. Doing things in clo
        • by suv4x4 (956391)
          Doing things in closed-source proprietary drivers and calling the operating system useless is a bit disingenious - but something an MS shill or Apple fanboy would do.

          Maybe an MS shill or Apple fanboy or [insert tired cliche here] would call Linux useless. Good thing I didn't.

          Would a Linux fanboy bend my words to fit his black-and-white world?
      • by CaptnMArk (9003)
        No, the problem is people programming applications using the principle of least resistance.
      • Re:Windows coders (Score:5, Interesting)

        by erroneus (253617) on Wednesday July 18, 2007 @07:34AM (#19899277) Homepage
        No, that is not my point.

        As the PC developed, IO calls were to be linked through the BIOS. The idea was that each device was to have a ROM that linked itself to the system's BIOS and that there would be a more unified system for handling I/O. Well, for most people, BIOS wasn't fast enough so people started writing code to work around it. And that's where the PC's "bad programming habits" began and it just got worse from there.

        Now, instead of people using the Windows API properly, people are using undocumented APIs that are subject to undocumented change, people are still trying to squeeze more performance from their apps by moving code into ring-0 virtual driver code. If you don't already know, "ring-0" means the code has access to the entire machine and all memory. And when apps misbehave, they are flying without a net since the ring-1 and above offer levels of "protection" from misbehaving or malfunctioning apps.

        This culture of performance over stability and proper coding methods has undermined the security and stability of Windows. I'm not going to assert whether or not Microsoft is partly to blame or has any blame in this. But I will say that Windows coders have bad habits that are quite common and prevalent.

        As Linux coders grow in numbers, it is more and more important that things like abusing root or setting up kernel modules unnecessarily should be protested and prevented at every turn. To not fight it could result in the same problems and reputation that Windows now enjoys.
      • by rbanffy (584143)
        No. It's still far more secure than Windows (or Macintosh, largely), since, in this case, you have to run a proprietary installer for a particular brand of printer/scanner I happen not to use (and that I won't recommend to anyone) and not use the mechanisms for software management built into any modern operating system (such as Red Hat, Debian or Gentoo).

        Windows requires to run installers at elevated privilege levels to install things as trivial as a music players and, those, not rarely, intermingle themsel
        • by drsmithy (35869)

          Windows requires to run installers at elevated privilege levels to install things as trivial as a music players and, those, not rarely, intermingle themselves into the operating system in ways it makes impossible to get rid of them after you no longer need them.

          Windows, like Linux, "requires" nothing of the sort.

      • by ajs318 (655362)
        Much of the security of Linux comes from the Open Source nature of much of the software that makes it up.

        We (that is, the ones who have used Linux since the days before it became all cuddly) use Linux because we want to keep full control of our systems -- and we know that i-tal software is the first of many steps towards that goal. But most people don't understand the implications of Closed vs. Open Source, and will choose -- because they don't know any better -- to pollute their system with a closed-s
      • If those driver's were Open Source, this would've been fixed by now and the Samsung programmer's would've been taught a small lesson in how to program properly. As it is, they're probably sitting there saying to themselves "Why does anybody care? It works, doesn't it? We did just fine and all these idiots are just nitpickers, why don't THEY write the stupid driver!"

        The problem with Windows is the development model, not the number of people writing code for it.

  • suid is evil! (Score:2, Informative)

    by PetriBORG (518266)
    Once more boys and girls, say it with me now, SUID IS EVIL! :-)
    Nothing but the programs that absolutely have to should be run as root.

    Is there an English (not some auto-translated forum) site covering this? I think its talking about this suid run printer driver [openprinting.org]?

    • Re: (Score:2, Interesting)

      by StripedCow (776465)
      And repeat after me: "proprietary" is even more evil than suid!
      • by Ash Vince (602485)
        "proprietary" is even more evil than suid!

        No it isn't.

        I write proprietary code for a living as do plenty of other people here I'm sure. Why should everybody have to release code as open source? Some of us would like to get paid for what we do without having to "add value" by offering support services as well.

        In terms of Linux drivers there are several reasons why companies do not create or want open source drivers for their hardware. The most obvious one being that you are trying to keep exactly what the ha
    • Re:suid is evil! (Score:5, Informative)

      by nagora (177841) on Wednesday July 18, 2007 @07:13AM (#19899121)
      Once more boys and girls, say it with me now, SUID IS EVIL! :-)

      SUID does not have to set id to root; my printing scripts are all setuid to "lp"; my mail servers are suid to "mail". This is a good thing.

      TWW

  • Thank you! (Score:5, Funny)

    by mwvdlee (775178) on Wednesday July 18, 2007 @07:02AM (#19899031) Homepage
    A big "Thank You!" to Samsung for demonstrating that propriatory code is inherently less secure than open source, if only because you can (could) get away with insecure code.
    • by suv4x4 (956391)
      A big "Thank You!" to Samsung for demonstrating that propriatory code is inherently less secure than open source, if only because you can (could) get away with insecure code.

      A big "Thank You!" to you for the most of the world hating Linux.
      • A big "Thank You!" to you for the most of the world hating Linux.
        there are over 6 billion people in this world. "most" would have to be more than half.... So you are asserting that more than three billion people hate Linux? Thank you for pulling another stupid statistic out of your ass..... I'd think you've be hard pressed to prove that more than half of the world even knows what Linux is, much less "Hating" it....
        • by mwvdlee (775178)
          I actually feel kinda proud that he blames me personally for making 3 billion people hate Linux... imagine what else I could do with such enormous powers of persuasion? :)

          Either way; anybody who can love or hate an OS needs to see a psychiatrist, just like you should if you love or hate a screwdriver, a hammer or any other tool.
          • by Znork (31774)
            "just like you should if you love or hate a screwdriver, a hammer or any other tool."

            Mmm, when your purchasing department gets a nice lunch in exchange for exclusively buying screwdrivers and you're forced to use the screwdrivers to hammer in nails all day long, I wouldnt be surprised if you develop some excessively strong emotions towards both screwdrivers and the manufacturer of said screwdrivers.

            Wether it's entirely rational or constructive is perhaps questionable, but as far as mental health goes it sur
    • by plague3106 (71849)
      Wow, nice spin. The code itself is secure I image. I didn't notice in the translation that the driver itself was vunerable to an attack, just that the installer changed file permissions it shouldn't have. So this has nothing to do or not whether the code itself is secure, it has to do with what the binary is doing.

      I guess you've never heard of an old UNIX compiler that inserted malicious code into otherwise clean source code, have you? Open source doesn't stop that, does it?
      • by mwvdlee (775178)
        Yes, I know about that GCC hack (i'm assuming this is what you mean since you mention both UNIX and open source) and about the trouble they had getting it out. But they did get it out. So yes, even open source can contain bad code. We're all only human after all. But it does get a lot harder to keep such things hidden, and when found it's a lot easier to get rid of it.

        By "insecure code", people usually don't just mean unintended problems like buffer overflows but also about intentional functionality that cr
  • by Anonymous Coward
    What were they trying to do that made them think OpenOffice needs to be setuid:root?

    Windows ME(tm)(r) Security(tm)(r)(c)(*) now available on Linux, brought to you by Samsung(tm)(r)
  • by Simon (S2) (600188) on Wednesday July 18, 2007 @07:06AM (#19899067) Homepage
    I find it very disappointing anyway that anything you install on ubuntu is installed as root (at least that is the default way of doing it). Wouldn't it be übercool to be able to install applications as the local user, and drivers maybe as the "driver" user? I still think The Zero Install system [0install.net] is a nice and secure way to install software, and maybe one day we can extend this to install drivers as well, so that root access will almost never be required (a bit like Plan 9, or what SE Linux is trying to do).
    • by vadim_t (324782) on Wednesday July 18, 2007 @07:26AM (#19899213) Homepage
      Wouldn't change much really.

      This works OK for a multiuser system. If you run systems with 100 users on each and one gets their home directory hosed, you restore from backups and problem solved. Everybody else continues having uninterrupted service meanwhile.

      But on a personal box everything of importance is in $HOME anyway.

      What is needed is something like SELinux, which makes it impossible for applications to do things they shouldn't be doing.

      I say "something like" because SELinux is a very complicated system and AFAIK still badly documented. But it sounds like a step in the right direction.
    • by MrNemesis (587188) on Wednesday July 18, 2007 @07:41AM (#19899355) Homepage Journal
      If you allow the local user to install programs, then the local user is either;
      a) going to need write access to all the usual locations (either /usr/bin and /usr/lib, or /opt) which wouldn't solve the problem TFA is on about
      b) going to need to use some middleware that *does* have rwx access to /usr and a fine grained ACL system dictacting which users have access to what

      "Driver" installs just need access to /lib.

      Fact of the matter is that whatever user/process has the rights to install apps has the rights to fuck them up as well. Much like how windows can't help it if the user runs trojan_setup.exe.

      As ther other poster noticed, things like SELinux offer incredibly fine grained access over what various users can and can't do, and if you go through the (fairly considerable) pain of setting it up it can give you an amazingly secure setup, but there's no way in hell it'd fly with everyday users or even most sysadmins. This is why Linux distros take such care with package management and like to retain control over their repositories - because they can't risk a third party, closed source package coming in and accidentally running a chmod -R 777 / on install. When you're dealing with companies that seemingly have little knowledge of Linux development and security models, this is a very real threat.
    • by rbanffy (584143) on Wednesday July 18, 2007 @08:13AM (#19899701) Homepage Journal
      Synaptic (and APT) are system-wide software-management tools and thus require root privileges. OTOH, it would be cool to be able to allow any user to install a program for himself and still keep it under package management.
  • quoi le baise? (senseless translation of 'wtf')

    Does anyone have _any_ idea why they did this?

    Fortunately, I don't use the drivers supplied by Samsung for my printer. They are crap. The foomatic one works just fine, though.
    • I am just guessing, but I would imagine that the drivers are in the form of a shared library that talks directly to the printer device. In order to talk to the printer device, the process to have permission to write to /dev/whatever, and the easiest way of doing this is to run as root. A more UNIX-y approach would be for the driver to be a filter that read something like PostScript from stdin and wrote printer commands to stdout. This could be run as a completely unprivileged user, with the printer daemo
  • no user is going to be able to install such a dangerous "driver" without root access in the first place-- anyone can build a program, intentionally or accidently, that comprimises a system when ran/installed as root.
    • Re:to be fair (Score:5, Insightful)

      by Anonymous Coward on Wednesday July 18, 2007 @07:23AM (#19899197)
      no user is going to be able to install such a dangerous "driver" without root access in the first place-- anyone can build a program, intentionally or accidently, that comprimises a system when ran/installed as root

      Yes, but when you install a driver, you normally assume that it's not going to make your system insecure. Why should it? Only a very badly designed driver would deliberately break your system security.

      Sometimes drivers do accidentally introduce security problems. The Nvidia drivers for X have done this in the past, for example. In those cases, it's not bad design, it's an oversight of some sort, like a buffer overflow.

      But this is not an oversight. A deliberate design decision has been made to break the Linux security model. A very special type of stupidity is involved: one that includes an understanding of the effects of the setuid bit, but excludes an understanding of the security implications.

      Samsung should investigate this fully - who knows what other retarded decisions have been made by these guys?
  • It come out... (Score:5, Informative)

    by dmayle (200765) on Wednesday July 18, 2007 @07:15AM (#19899143) Homepage Journal

    For those who can't read French, the Ubuntu forum is just a posting of a link to another forum where it was noticed. The posting, along with the interesting source can be found at http://linuxfr.org/forums/15/22562.html [linuxfr.org] The interesting parts are:

    wrap_setuid_third_party_application xsane
    wrap_setuid_third_party_application xscanimage

    wrap_setuid_ooo_application soffice
    wrap_setuid_ooo_application swriter
    wrap_setuid_ooo_application simpress
    wrap_setuid_ooo_application scalc

    The script copies the affected application's executable to one with a .bin extension, and replaces it with an suid wrapper script. This is undoable, but god, what a mess!

    Okay, I couldn't overcome the lameness filter, go to the source to see for yourselves...

  • ...I would not call this a mere bug. This was an intentional attempt to create a backdoor. Come on, who believes that a very specific driver of all things changes the permissions of a very unspecific program like OpenOffice? Something like that does not happen by accident.

    Ok, I might be wrong with my accusation, but in this case I'd say I don't have to prove it, but Samsung has to prove its innocence by making public in details how exactly it came to this 'bug'.
    • by east coast (590680) on Wednesday July 18, 2007 @08:55AM (#19900209)
      This was an intentional attempt to create a backdoor.

      So when this same type of thing happens in Windows it's that Windows coders are inept but when the same happens in Linux it's because of a conspiracy? Please.

      The Linux community better be damn well ready for when this becomes commonplace as more people use Linux. I don't expect it as much from real vendors but it's going to happen more from the likes of amateur coders and malware producers.

      Too many have fallen pray to the myth that Linux isn't going to have some of the same issues that Windows has with these areas in software. This incident alone shows that Linux will not be immune to those who don't care enough, don't know enough or are willing enough to sacrifice system security for whatever reasons.
  • by VE3OGG (1034632) <VE3OGG@@@rac...ca> on Wednesday July 18, 2007 @07:45AM (#19899377)
    Hello,

    After I installed the unified drivers for my Samsung printer/scanner, I had the unwelcome surprise of discovering that OpenOffice now opens as root, and not only that but did not ask for my password!

    As a result, all documents I created were saved in the /root/ directory with super user rights. Practical and super secure!

    I attempted to re-install .Xauthority without success.

    The beast (the problem) is occuring under Ubuntu 7.04 under Gnome.

    Thank You.

    Bonjour,

    Après avoir installé les drivers unifiés de Samsung pour gérer mon imprimante scanner, j'ai eu la très mauvaise surprise de constater que la suite openoffice s'ouvrait en root et ceci sans que me soit demandé le moindre mot de passe !!!

    Du coup, les documents que je crée s'enregistrent dans le dossier /root/ avec des droits de super utilisateur. Pratique et super sécure !

    A tout hasard j'ai réinitialisé le .Xauthority : aucun succès.

    La bête est sous Ubuntu 7.04 et gnome. En attendant vote aide, je cherche et tente de résister au désespoir le plus sombre !

    Merci
  • Time to Get Heavy (Score:5, Insightful)

    by ajs318 (655362) <sd_resp2@@@earthshod...co...uk> on Wednesday July 18, 2007 @07:48AM (#19899425)
    The proprietary driver fiasco has gone on far too long. It's time to stand up and say Enough Already!

    Let's all get writing to our elected representatives and demand that hardware manufacturers be obliged, by law, to provide detailed specifications which would enable a sufficiently-competent programmer to write a driver program enabling any of the features of their product to be used on any sufficiently-capable computer.

    Failure to do this places the rightful owners of hardware at a disadvantage. They can only use it in conjunction with certain Operating Systems. They are restricted to using it as the manufacturer thought fit. If a driver has a programming flaw, the user's computer can be compromised. If the Operating System is updated in such a way as the driver no longer works, the user is at the mercy of the manufacturer to release a new version of the driver -- or else the hardware is unusable (or at best, usable only through a bodge involving multi-booting: at the boot prompt, type linux to be able to use the Internet, or linuxOLD to be able to print).

    It's unfortunate, but this measure really needs to be brought in through legislation, because manufacturers will not do it voluntarily. There are two reasons: (1) they are paranoid of competitors {despite the fact that their competitors are busy reverse-engineering their products in secret while they reverse-engineer the competitors' products} and (2) they habitually lie through their back teeth in their advertising literature about the capabilities of their hardware, and such lies would be exposed with disclosure (e.g. a camera with a 2 megapixel image sensor, spitting out JPEG images interpolated up to 6 megapixels).
    • Re: (Score:3, Funny)

      by Xeth (614132)
      +4, funny? Ouch. I guess we are a cynical bunch. Next up: The "-1, Pointless idealism" mod?
  • by Jerry (6400) on Wednesday July 18, 2007 @07:58AM (#19899535)
    Here is a posting to the Ubuntu forum that is SEVEN MONTHS old and refers to postings A YEAR OLD!

    Printer drivers need to be installed with world execute permissions so that all users on the system can access the printer. The Samsung hacker's method of doing this, converting them to 4755 bin files and setting the original name as a link to the bin files, is one way of doing that -- IF his "unwrap" function had worked properly. That's the bug. Listed in the posting are files whose permissions need to be modified after the driver is installed.

    #1
    Old January 18th, 2007
    tweedledee tweedledee is online now
    Way Too Much Ubuntu

    Join Date: Dec 2006
    Beans: 252
    Ubuntu 7.04 Feisty Fawn User
    HOWTO Install Samsung Unified Printer Driver
    I had a fair amount of trouble initially getting my Samsung printer installed completely, but I finally have it all done, so here's a mini-guide for those who might benefit.

    NOTE: for the last few months, the Samsung website has been utilizing some buggy Flash code that will crash many (all?) Linux browsers that have Flash installed - hopefully they will fix this soon, but they don't seem in any hurry. Either use a secondary browser that does not have the Flash plugin installed (e.g., if you mainly use Firefox, you could use Epiphany (Gnome) or Konqueror (KDE)) or download the drivers via another computer/OS. Alternatively, again if you use Firefox, you can install the "flashblock" extension, usually this prevents the crash (and is useful for many of the other websites that have been appearing recently causing the same behavior, although it's not 100% successful).

    EDIT: The newest (as of this writing) driver from Samsung (20070324...) appears to solve some of the mfp/xsane issues, but also appears to missing a couple of library files. See post #23 for details. Also see posts #27-29 for details on ...plc errors and solutions.
    Post #35 suggets the 200704.... drivers have resolved this issue, so this may now be irrelevant.

    First, a disclaimer: much of the information I used came from this thread: http://www.ubuntuforums.org/showthread.php?t=28774 7 [ubuntuforums.org]. Another good source of information is http://www.linuxprinting.org./ [www.linuxprinting.org] Finally, I did this using the 20060719... and 20070125.... drivers; newer (or older) drivers may require some tweaks. Also, especially if you have a monochrome, non-duplexing, non-multifunction printer, you very well may have success with a generic post-script printer as a driver, without having to install the Samsung drivers. Also note that for my printer, pretty much all functions except duplex control worked even if I skipped steps 2-4 below (i.e., don't install the driver, only the relevant .ppd file) - which also has the advantage of not needing to fix xsane (additional step 2).

    This works for my CLP-550; similar steps seem to work for other Samsung printers not supported out-of-the-box with the drivers available in a fresh Ubuntu install. This is NOT a multi-function, multi-functions may require additional steps (but are discussed in other threads, a quick search should bring them up). Posts below from other users have reported sucess (sometimes with a couple of small modifications) with: ML-2510 (# 5, 14, 16, 26), ML-2510/XEU (# 18 ), ML-2571n (# 12), SCX-4200 (# 10), SCX-4521F (# 11), CLP-300 (# 35).

    1. Download and untar the driver from Samsung's website; for this example I will assume you untar it to ~.
    2. Open a terminal and navigate to ~/cdroot/Linux. I had to "chmod +w install.sh" to give write permissions, but that may be unusual. Edit install.sh as follows:
    a: change the first line from "#! /bin/sh" to "#! /bin/bash" (without the quotes)
    b (possibly not needed): change the line that includes "guiinstall.bin" (search for it, it's around line 1277) to eliminate the ".bin" (i.e

  • I have a Samsung ML-2251N printer and the installer also replaces the standard lpr command by symlinking it to a script called slpr, which brings up a windows-like print GUI when you try to print things. This is highly annoying as it doesn't behave exactly like lpr and requires a GUI. It may also be SUID as well.

    You can remove all of the SUID crap and point /usr/bin/lpr back to the right place. The proprietary driver still works and is much more secure. It prints faster with the Samsung driver than with the
  • Any printer that requires more than a PPD and CUPS to operate is suspect.
  • It can join the good company of General Protection Fault, or Kernel Panic
  • This may not be that big a problem -- at least for the Samsung color laser printers. Why not? Because the Linux installer for those printers seems to be unusable on many new Linuxes. The installer is dynamically linked to libraries that are no longer used and it apparently doesn't install properly when newer versions of the libraries are linked. It took me a number of days to get a CLP-300N printer working with the Samsung drivers. There is an alternate open source driver called foo2qpdl that does work
  • This is only an issue because Windows has moronised people into expecting that they must download an unverified, untrusted executable from a third party web site and execute it with full system privileges.

    Thanks, Microsoft!

    Stick with your distribution's official package archive and this simply won't happen.
  • The bug is that the driver actually tries to UN-suid the applications: unwrap_setuid_third_party_application xsane unwrap_setuid_third_party_application xscanimage wrap_setuid_ooo_application soffice un wrap_setuid_ooo_application swriter un wrap_setuid_ooo_application simpress un wrap_setuid_ooo_application scalc un But they screwed up the oo unwrap part. The "un" should be BEFORE the "wrap" on those li
    • It suids the apps temporarily, and improperly un-suids them.

      OK, I read this message, and I can't understand why on earth any software would need to, even temporarily, set the setuid bit on anyone else's software. What's the purpose of this action?

There is no opinion so absurd that some philosopher will not express it. -- Marcus Tullius Cicero, "Ad familiares"

Working...