Security
Brief items
I expect you to boot Linux, Mr. Bond
The posting on the xbox-saves site came out of the blue: a previously unknown person going by the name "habibi xbox" had figured out how to boot Linux on an unmodified Xbox game console. The scheme takes advantage of the fact that the game "007: Agent Under Fire" has a buffer overrun in its game restore code. All the evil agent from S.P.E.C.T.R.E. need do is dress up a malicious save file in suitably attractive attire, and 007 finds himself overrun by a hostile Linux bootloader. Not only is Mr. Bond unable to prevent World Domination this time around; he actually becomes an agent for the other side.The Xbox, of course, is Microsoft's entry into the game console market. The hardware is very PC-like, but it is designed to not run software which has not been signed by the requisite private key. This feature gives Microsoft the power to say what can run on its hardware - and to extract a toll from anybody wishing to sell games for the Xbox platform. Not too many people have been surprised by the fact that Microsoft has not expressed great interest in signing a Linux bootloader to enable Linux to run on the Xbox.
Xbox linux has been possible for some time, as long as you're willing to open up the box and solder in a new chip. That works for hardcore hackers, but Aunt Tillie tends to balk at such things. The 007 exploit, while not requiring that the box be opened, is still not the most straightforward operation to carry out. But it is a step in the right direction.
The real significance of this exploit, however, is in what it says about trusted computing platforms in general. The hardware has been designed to run nothing but "trusted" software, but what happens when that software is subverted? At that point, the only thing to be done is to try to contain the damage. As long as the software remains insecure, the hardware will fall short of its "trusted" pretentions.
Consider that the software for a game console is a product with a short shelf life. Games have to make the bulk of their money over a period of a few months. So one cannot count on these games going through an extended security audit prior to being signed and distributed. Platforms like the Xbox are guaranteed to be running buggy software for the forseeable future.
New vulnerabilities
Ecartis/listar allows unathorized password change
| Package(s): | ecartis, listar | CVE #(s): | CAN-2003-0162 | ||||
| Created: | March 27, 2003 | Updated: | April 2, 2003 | ||||
| Description: | A problem has been discovered in ecartis, a mailing list manager, formerly known as listar. This vulnerability enables an attacker to reset the password of any user defined on the list server, including the list admins. | ||||||
| Alerts: |
| ||||||
sendmail - buffer overrun
| Package(s): | sendmail | CVE #(s): | CAN-2003-0161 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | March 31, 2003 | Updated: | April 30, 2003 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | There is yet another buffer overrun in sendmail; this one was discovered by Michal Zalewski.
From the CERT Advisory:
"There is a vulnerability in sendmail that can be exploited to cause a denial-of-service condition and could allow a remote attacker to execute arbitrary code with the privileges of the sendmail daemon, typically root." Sendmail 8.12.9 was released with a fix for the problem. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
vsftpd: re-enable tcp_wrappers support
| Package(s): | vsftpd tcp_wrappers | CVE #(s): | CAN-2003-0135 | ||||
| Created: | April 1, 2003 | Updated: | April 2, 2003 | ||||
| Description: | In Red Hat Linux 9, the vsftpd FTP daemon switched from being run by xinetd
to being run as a standalone service. In doing so, it was accidentally
not compiled against tcp_wrappers.
Users of vsftpd who make use of tcp_wrappers features are advised to upgrade to these errata packages. This issue only affects Red Hat Linux 9 boxed sets manufactured for distribution within the United States. The part numbers, which can be found on the bottom flap of the box, are RHF0120US and RHF0121US. Copies of Red Hat Linux 9 obtained through other means (such as from Red Hat Network, FTP, or international boxed sets) already contain the packages referenced by this erratum, and are not vulnerable to this issue. | ||||||
| Alerts: |
| ||||||
Resources
Linux Advisory Watch
The March 28 Linux Advisory Watch newsletter from LinuxSecurity.com is available.
Page editor: Jonathan Corbet
Next page:
Kernel development>>