Cambridge Researcher Breaks OpenBSD Systrace 194
An anonymous reader writes "University of Cambridge researcher Robert Watson has published a paper at the First USENIX Workshop On Offensive Technology in which he describes serious vulnerabilities in OpenBSD's Systrace, Sudo, Sysjail, the TIS GSWTK framework, and CerbNG. The technique is also effective against many commercially available anti-virus systems. His slides include sample exploit code that bypasses access control, virtualization, and intrusion detection in under 20 lines of C code consisting solely of memcpy() and fork(). Sysjail has now withdrawn their software, recommending against any use, and NetBSD has disabled Systrace by default in their upcoming release."
I'm not worried (Score:3, Funny)
No need for alarm! (Score:5, Funny)
Re:No need for alarm! (Score:5, Funny)
All twelve of them. :)
I like the thought of openbsd, though, having never used it. I'm sure everything will be fine.
Re:so much for... (Score:5, Funny)
OpenBSD Security (Score:4, Funny)
As long as I'm dreaming, I also want a pony.
Ha Ha (Score:5, Funny)
$#%#^&&!#$@$
[CONNNECTION LOST]
Brace for impact... (Score:5, Funny)
Re:I'm not worried (Score:5, Funny)
Re:no (Score:5, Funny)
Re:Article? (Score:1, Funny)
Yes.
Re:No need for alarm! (Score:5, Funny)
We yell really loud.
(And I actually yelled "Wow!". We're not a homogenous lot.)
Re:Article? (Score:3, Funny)
Re:so much for... (Score:5, Funny)
In other words... it's in your list of the 5 best OSS projects.
(sorry)
Re:OpenBSD Security (Score:3, Funny)
You mean like, put it in a convent [wikipedia.org] or something ? Oh no, I get it, you mean he should build a little chapel in memory of it, right ?
Re:I'm not worried (Score:4, Funny)