Multiple Vulnerabilities in OpenSSL 274
gfilion writes "Updated versions of OpenSSL are now available which correct two security issues: A null-pointer assignment during SSL handshake and an out-of-bounds read that affects Kerberos ciphersuites. Full advisory available on OpenSSL site and US-CERT."
Non-Exploitable Security DOS Exploit (Score:2, Informative)
Honestly people, is this really
CVSup; make buildworld && make installworld
Problem solved.
Re:Non-Exploitable Security DOS Exploit (Score:5, Insightful)
Re:Non-Exploitable Security DOS Exploit (Score:2, Flamebait)
Rather than racing around trying to be all things to all people, the *BSD developers concentrate on what they are good at: developing a darn good server OS.
For your average Linux user, this will be treated as a nuisance that interrupts them trying to get the latest unstable kernel compiled, for your average *BSD user, this is important stuff that affects the security of their IT infrastructure.
Re:Non-Exploitable Security DOS Exploit (Score:2, Insightful)
Get a life.
Re:Non-Exploitable Security DOS Exploit (Score:5, Insightful)
cvs, make and build sure.. But when it's click windows update, somehow it's some monumental task thats just the worst thing imaginable.
Re:Non-Exploitable Security DOS Exploit (Score:5, Insightful)
One noteworthy difference, however, is that none of the BSD or GNU/Linux update methods tell the vendor the software (and their versions) that you run [petri.co.il]. To their credit, at least, none of them (including Microsoft) collect any actual personally identifiable information.
Re:Non-Exploitable Security DOS Exploit (Score:5, Informative)
First thing it does is `rpm -qa` and sends that list right to RedHat.
It's really hard to know what updates to provide without seeing a list of software packages installed. Sure, they could differentiate between "Our" software and "Other" software in the list of installed programs, but that's just silly - send the whole list, and ignore the stuff you don't care about.
Re:Non-Exploitable Security DOS Exploit (Score:3, Informative)
That's the nice thing about Gentoo. I recieve the full software tree everything I emerge sync so only *I* know what I have installed.
Re:Non-Exploitable Security DOS Exploit (Score:3, Interesting)
Windows Update consists of at least 4 click-then-wait-a-while cycles before your software is updated, and several packages must be installed separately (MSIE, service packs, DirectX, etc). On Debian, at least, you can run one command (apt-get update && apt-get -y upgrade) that will often complete the entire upgr
Re:Non-Exploitable Security DOS Exploit (Score:2)
Well, Windows Update pretty much always insists on rebooting the machine, which is irritating to some users (i.e. power users). On *nix this only needs to be done for (fairly rare) kernel exploits and not simple library/program updates.
Re:Non-Exploitable Security DOS Exploit (Score:5, Informative)
Slackware Linux [slackware.com] also has this fixed. Incidentally, like the parent's subject line says, this is a minor vulnerability that at the most makes openssl crash, not an exploit or a trojan like all the stuff we've been seeing about Windows on /. lately.
Re:Non-Exploitable Security DOS Exploit (Score:5, Insightful)
Yes. Most of us are not on the FreeBSD mailing list. Instead we wait for the more mainstream outlets like
Re:Non-Exploitable Security DOS Exploit (Score:5, Interesting)
For people who've never done this before (such as myself), this is an intimidating operation; care to walk me through it? It also glosses over insignificant little details, such as:
Dumb questions I'm sure, but the answers have never been revealed in a form I can understand.
Schwab
Re:Non-Exploitable Security DOS Exploit (Score:5, Informative)
Copy it from
Over a period of several updates, how do you avoid having stale libraries/executables/config files scattered all over your machine?
That's a fine question indeed. What I do is:
make DESTDIR=/usr/local/fake_root distrib-dirs distribution
make DESTDIR=/usr/local/fake_root installworld
make DESTDIR=/usr/local/fake_root installkernel KERNCONF=foobar
/usr/local/fake_root and stuff in /. I like find and sort and vimdiff to do that. It's not super elegant, but you don't have to do it too often if you're tracking something like RELENG_4_9, since rarely do things get updated. What you would use it for is when you make changes to the base, which leads me to:
/etc/make.conf, do:
Then you can compare the contents of
Is there a risk that 'make installworld' will silently overwrite a functional replacement previously installed from ports?
Yes! But you can get around it. In
NO_SENDMAIL=true
Now sendmail won't be built, although its stale files will hang around; refer to point 2 above.
You'll also, in rc.conf, want:
sendmail_enable="YES"
sendmail_flags="-bd"
sendmail_outbound_enable="NO"
sendmail_submit_enable="NO"
sendmail_msp_queue_enable="NO"
At least for Postfix, which you say you use.
Re:Non-Exploitable Security DOS Exploit (Score:2)
What I do is "emerge -u openssl."
For me it seems easier, but what the hell do I know.
Re:Non-Exploitable Security DOS Exploit (Score:2, Funny)
cvsup....
cd
make
make install
Re:Non-Exploitable Security DOS Exploit (Score:4, Informative)
First, RTFM:
http://www.freebsd.org/doc/en_US.ISO8859-1/books/
http://www.freebsd.org/doc/en_US.ISO8859-1/books/
I run 4-STABLE on all of my boxes, so this will be a bit different for 5. Create
CFLAGS=-O -pipe
NOPROFILE=true
NO_BIND=true
NO_SENDMAIL=
SUPHOST=cvsupXX.freebsd.org
SUP_UPDATE=yes
SU
SUPFLAGS=-g -L2
SUPFILE=/usr/share/examples/cvsup/stable-sup
PORTSSUPFILE=/usr/share/examples/cvsup/ports
Replace SUPHOST with your CVSup mirror. See the handbook [freebsd.org] for more info. The NO_BIND and NO_SENDMAIL lines keep buildworld from building BIND and Sendmail, respectively, since I use djbdns and qmail.
Once you have setup
# cd
# make update
That will also update
Once your source tree is up to date, update the system following section 21.4.1 in the handbook. I skip the single user mode part, since I do everything over SSH:
# mergemaster -p
# rm -rf
# make -j4 buildworld
# make -j4 buildkernel
# make installkernel
# make installworld
# mergemaster -i
# reboot
The order there is important. The kernel should be built after the world is built, since building the world updates the build tools (this is especially important when it has been a long time since you last updated). The kernel should also be installed before the world is installed.
You should almost always update the kernel when you update the world. If you choose not to reboot immediately after installing the new world, you might notice that tools like ps no longer work, since they don't match the kernel.
These is how I do things after several years of experience. Make sure to read and understand the handbook before doing anything. But really, it's not that hard, especially after you do it a few times.
An unrelated but very useful tip: check out the sysutils/portupgrade port.
Re:Non-Exploitable Security DOS Exploit (Score:3, Insightful)
Oh... that's MUCH easier than Windows Update. Can't wait for my mom to try doing this...
</asbestos suit>
advice on cvsup (Score:4, Insightful)
There is a minimal cvsup config for FreeBSD 4.9 - cvsup -g -L 2 and you're off and running.
*default host=cvsup6.FreeBSD.org
*default base=/usr
*default prefix=/usr
# The following line is for 4-stable. If you want 3-stable or 2.2-stable,
# change "RELENG_4" to "RELENG_3" or "RELENG_2_2" respectively.
*default release=cvs tag=RELENG_4
*default delete use-rel-suffix
# If your network link is a T1 or faster, comment out the following line.
*default compress
src-all
#ports-all tag=.
make buildworld & make installworld install *world*, which does not include anything you built out of
FreeBSD *is* intimidating at first, but if you take the thirty days of pain at the end of that time you'll be looking at your Linux boxes and wondering why you ever put up with the chaos
Re:Non-Exploitable Security DOS Exploit (Score:2)
Haven't looked back since.
Dave
Re:Non-Exploitable Security DOS Exploit (Score:4, Informative)
For people who've never done this before (such as myself), this is an intimidating operation; care to walk me through it?
If you're intimidated by buildworld, there's an easier option:
# freebsd-update fetch
# freebsd-update install
Re:Non-Exploitable Security DOS Exploit (Score:5, Insightful)
Yes, lets just wait till some kiddie write a worm that crashes thousands servers all over the world and then post about it.
I like that slashdot posts security problems. Why?
1. For the lazy admin. Theres lot of them.
2. because its important to keep reinforcing the idea that computers suck (I dont care what OS you like) and need constant care.
Re:Non-Exploitable Security DOS Exploit (Score:2)
1. For the lazy admin. Theres lot of them.
[Raises hand.]
I know security is important, but I know time is finite.
Slashdot stories like these are kind of like
Sure you could monitor the raw feeds and find out earlier and in greater detail, but that takes time and attention away from other stuff.3 actually (Score:5, Informative)
Here [uniras.gov.uk]
There are three vulnerabilities.
This was, like, sooo yesterday on the Bugtraq lists
Re:3 actually (Score:4, Funny)
Microsoft fans - "see, Linux/FOSS have security issues too"
Linux fans - "yeah, but we fixed this right away. If this was Microsoft, we would have been waiting for months"
Repeat again and again..
Netx topic please..
Re:3 actually (Score:4, Informative)
Re:3 actually (Score:4, Funny)
Re:3 actually (Score:2, Funny)
Re:3 actually (Score:5, Funny)
Anyway, we need to rewrite the entire thing in the elegant languages of the 21st century. I suggest this [slashdot.org]
Re:3 actually (Score:3, Funny)
C is the devils tool.
Funny? I would say "Insightful". Use Java! (Score:2)
performance hit (Score:2)
c is just one step away from being a macro assembler, so it's very fast. it's suitable for writing hardware device drivers, something most other languages are not. you won't be seeing any gigabit ethernet drivers written in java, for example. unless you want your gigabit ethernet driver to perform like 10mbit
the reason there's pointers, etc. is because that's the way CPUs operate. C being such a lowlevel language inhe
Re:3 actually (Score:2)
I understand pointer math. I know how to use (and indeed, have used) 4-dimentional arrays of complex data types, and I've written an infinite loop intentionally (the trick is to use an external event to change the otherwise-infinite boundry condition)
The fun one is taking a pointer to a one-character array, then when you know what size your objects are going to be, cast the pointer to a pointer of the correct size, then do pointer math on a big chunk of memory to build
Re:3 actually (Score:2)
Re:3 actually (Score:5, Informative)
Let's be like M$... (Score:4, Funny)
Re:Let's be like M$... (Score:5, Funny)
Re:Let's be like M$... (Score:5, Insightful)
It's fairly reasonable to assume that the developers knew of the vulnerability some time before the new version became available.
I think it's good practice to do this if you can develop the new version fast enough. Announcing it early is only inviting someone to exploit it. I doubt anyone will fix the vulnerability themselves and put it into production before the official release comes out.
Actual Threat? (Score:2, Interesting)
Re:Actual Threat? (Score:2, Interesting)
Re:Actual Threat? (Score:2, Interesting)
before the trolls start... (Score:4, Insightful)
Also I think this is a good news post simply because it helps to show we're not Anti-windows bias. We report security problems on ALL os's.
Oh well, sometimes you just have to combat the trolls.
Re:before the trolls start... (Score:5, Informative)
Re:before the trolls start... (Score:2)
Is OpenSSH affected by this problem? AFAIK SSH doesn't use the SSL protocol. So if SSH just use the cryptographic primitives from OpenSSL, and the vulnurability was in another part of the code, how could SSH be affected?
Re:before the trolls start... (Score:2)
Um... Yeah. Because this is where I go for all the breaking news in the HP-UX or AIX world, right? Sorry. Half the crowd is pro-windows biased, half the crowd is anti-windows biased and half the crowd lies by saying they aren't biased either way. You only hear about the OSs that make for a good holy war on
Re:before the trolls start... (Score:2)
150% of the crowd cannot even use correct percentages, and make subjective opinions on matters they know nothing about
But keep on trucking...you hit quite a few good catchphrases, including but not limited to: pro-windows *3, anti-windows *2, OS *2, zealot, dorks*2, open source,
Re:before the trolls start... (Score:4, Informative)
Re:before the trolls start... (Score:5, Funny)
This just out from MSFT:
Re:before the trolls start... (Score:2)
Bullshit... (Score:4, Funny)
For the love of god (Score:5, Funny)
Okay, maybe not less funny - but just as unfunny.
Old news (Score:3, Insightful)
Re:Old news (Score:2)
Re:Old news (Score:2)
Speedy Cert (Score:2)
You're joking, right? A day is flat-out amazing. CERT used to take months to announce stuff. It was a joke; I unsubscribed because at the time, I found out about stuff in updated RPM changelogs well ahead of when I read it in one of CERT's email alerts. They'd often take over a week to send an email out about a virus that had already thoroughly spread.
Re:Speedy Cert (Score:2)
Move along (Score:5, Informative)
Nice to hear that they found the holes, though.
Re:Move along (Score:2)
No, but... (Score:2)
Kjella
Re:No, but... (Score:3, Informative)
I guess you start your critical ssl apps out of the rc scripts don't you?
A well built server can take a # kill -9 -1 and still keep on going. (thats kill -SIGKILL every process)
RedHat 7.2/7.3 not supported, yet (Score:2)
Re:RedHat 7.2/7.3 not supported, yet (Score:2)
If you enjoy torturing yourself, compile everything from scratch. Once you've done this, you have to chase down every update in anything you ever compile for the duration of the life of the machine, as well as beat out any changed dependencies.
It's not as bad if/when you use a tool like checkinstall...
Re: (Score:2)
Re:RedHat 7.2/7.3 not supported, yet (Score:2)
Keeping track of every individual package on 20+ systems and their update status can be quite torturous.
Or, do you have no trouble keeping "the server" under your bed (that shares MP3s to your roomie down the hall) updated?
Re: (Score:2)
Re: (Score:2)
Re:RedHat 7.2/7.3 not supported, yet (Score:2)
My friend, you have hit the nail on the head. I do an "up2date" or "yum -y update" on a particular server at least monthly. I'm anal about keeping patches updated. I do everything possible to avo
Not too big of an issue... (Score:5, Informative)
From the FreeBSD security list:
If one compiles OpenSSL oneself, *and* has MIT Kerberos, *and*
> enables the Kerberos options, *and* has all ciphersuites (or at least
> the Kerberos ciphersuites) specified in your application's
> configuration, then you might be affected. But that has nothing to
> do with FreeBSD.
> Thus, answering your question again:
>
> Isn't FreeBSD vulnerable to the second "Out-of-bounds read affects
> Kerberos ciphersuites" security problem?
>
> No, FreeBSD is not.
Re:Not too big of an issue... (Score:2)
Every day I am so happy I use freebsd. It's truly awsome. Stable as a rock and secure as a safe.
RedHat9 updates (Score:2)
Thanks.
Yawn (Score:4, Insightful)
Rule #1: Unsafe data should be handled in sandboxed languages.
Rule #2: Programs that are exposed to unsafe data (server processes) should run at some minimum and constrained privilege level, not as root. The "must be root to bind to ports less than 1024" rule on Unix is almost exactly the opposite of what the rule should be.
I'm sure many people who don't understand these issues will flame me or say I am trolling, but oh well, someone needs to keep bringing this up until it sinks in.
------------
Create a WAP server [chiralsoftware.net]
Re:Yawn (Score:3, Insightful)
People like you who don't understand that any software written in any language can be exploited should be shot. Your post is just painful to read.
Rule #1 is actually: VALIDATE ALL USER INPUT
This holds true for any language, c, java, php, brainfuck, or anything else. You can just as easily explo
Re:Yawn (Score:5, Interesting)
Sure, it's entirely possible to write perfect C code with no mistakes, and it's possible to not validate input on Java code and make plenty of mistakes. You gave a great example: SQL injection attacks. Java has some great defenses against that: Use java.sql.PreparedStatement instead of java.sql.Statement. Even better, use something like JDO to give an abstracted OO view of the data.
Here's where C breaks down: The human mind doesn't think in the right way to use C safely. We can't change the human mind (yet), but we can change which language we use. Humans just don't spot out-of-range errors, for example, but out-of -range errors are all trapped in Java and also because Java collections know their size (unlike C arrays/pointers) out-of-range errors are much more obvious.
Also, saying that "if you validate your input you can run it at any priv level you want" is just the wrong way to think about this. Mistakes will happen in any sufficiently large system (ie, any system that is large enough to be useful today). The only reasonable thing to do is to contain those mistakes, which means isolate processes and functions.
Or you can keep on repeating "nothing bad would ever happen if we didn't make any mistakes!" I guess if that's what you think, I can't change your mind.
Re:Yawn (Score:3, Insightful)
Openssl is coded in highly optimized C, with many components in assembly, and its still considered a high-overhead resource hog and is often the target of hardware acceleration.
If you seriously think "Java" is even in the running for that workload- then you are seriously deluded. VM's have this peculiar BIG problem: they are slow and resource-intensive. They dont play well with other processes, they cannot swap out to share ram, and they encourage memory bloat.
Re:Yawn (Score:3, Insightful)
Funny, then why have the qmail [cr.yp.to] and djbdns [cr.yp.to] security guarantees never been claimed? Perhaps because it really is possible to write secure code in C?
Re:Yawn (Score:2)
Hear, hear. I've always wanted a kernel option to disable that, as I'm the only user on my machines and it would be nicer if I could just run my daemons as non-root than being secure in the knowledge that all of the other (zero) people who have a
Re:Yawn (Score:4, Insightful)
Re:Yawn (Score:3, Insightful)
Rule #2: Ever heard of "bind to port and then change uid"?
I'm sure many people who don't understand these issues will flame me or say I am trolling, but oh well, someone needs to keep bringing this up until it sinks in.
Thanks for enlightening us all.
Re:Yawn (Score:2)
Having to be root to bind to ports under 1024. Yes, it's very silly. Why can't we get rid of that hangover now?
Re:Yawn (Score:2)
Because on multiuser systems where you for example don't run a web server you don't want random people poping up a server on port 80 pretending to be you. Of course you could firewall it off, but why not let the kernel take care of it?
Re:Yawn (Score:2)
Re:Yawn (Score:2, Informative)
But of course none of this would be necessary if everything possible was written in java. Then you wouldn't really have to worry because worst case scenario, you get an exceptio
Scary AND funny! (Score:4, Funny)
It really is. You need to take it seriously and fix it. ASAP. Hopefully, most folks who run said OSes are paying attention, and will do what they need to do to secure the flaw.
That said, every time anyone uses Outlook to read email, the above looks really, really good.
Redhat? (Score:5, Informative)
wget http://www.openssl.org/source/openssl-0.9.7d.tar.
tar xvfz openssl-0.9.7d.tar.gz
cd openssl-0.9.7d
make
make test
make install
Configure with "shared" because it will install the shared library, which is needed for other programs such as SSHD. The prefix is where RedHat put its *.so files that's needed by OpenSSH.
Not sure if it's required or not, but I just restarted SSHD (uses OpenSSL) after that just in case.
Btw, the above is just what I did. I make no warranties. Follow it at your own risk.
Re:Redhat? (Score:2)
Re:Redhat? (Score:3, Informative)
You need to monitor security lists (Score:4, Interesting)
Don
C language is (also) to blame. (Score:4, Insightful)
A null-pointer assignment
an out-of-bounds read
Aside from the programmer's errors, if C was safer, both bugs would have already been caught a long time ago. C is clearly to blame here.
Re:Patch updates are NOT news (Score:5, Funny)
Re:Patch updates are NOT news (Score:2)
Re:Patch updates are NOT news (Score:2, Insightful)
Until someone roots the Gentoo servers....
They are if you just got hacked... (Score:2, Informative)
Next morning, box his linux and windows box had been compromised.
Slashdot is a great forum for this type of critical patch. Gets the news out very quickly to people who dont read the security sites everyday.
Re:They are if you just got hacked... (Score:3, Informative)
Next morning, things were hosed. :(
The moral is if you need SSH, FTP or any other service up, keep one eye BugTraq... but slashdot posts a lot of the good ones for those of us who don't have time to read everything.
But, if you don't have a need for the service, shut down the port! NEVER lea
Re:They are if you just got hacked... (Score:2, Funny)
Re:Uhh (Score:2, Funny)
Point being: slashdot isn't news for good admins. It's news for nerds that are hopelessly wrapped up in battle between Open Source and the evil Micro$haft corporation that they fabricated to bring some drama to their dreary lives.
Hellooooo -1 country!
It's not as if (Score:2)
Re:Uhh (Score:2)
If one really want to discuss this, then there are other forums/mailinglists that are better suited. Even though many Slashdotters actually know what they talk about when posting, they are drowned by the noise from the unwashed masses.
Re:Why Is This Happening? (Score:3, Insightful)
Re:recompile ssh? (Score:2)
OpenSSL in Java would be too slow (Score:4, Interesting)
For most applications, you are right that safety outweighs performance concerns. However, OpenSSL is in that 1% of applications where performance outweighs everything. It is a crypto library. Crypto is extremely CPU intensive.
OpenSSL is expected to run as fast as possible, to the point where parts of it aren't even written in C. The core bignum and hashing routines are written in assembly language for various platforms.
You even mentioned this caveat:
if you're not writing an OS, a game, or a calculation based app (lapack, etc...)
But you didn't seem to realize that this caveat certainly applies to OpenSSL (if ever there were a calculation based app, this is it).