Security
Brief items
Hardening Linux against buffer overflows
Whenever kernel hacker Ingo Molnar disappears for a while, it is reasonable to expect that he will resurface with some interesting new development. In the past, he has materialized with the TUX in-kernel web server, the O(1) scheduler, and the new kernel threads implementation. His most recent offering, however, has to do with making Linux systems more resilient in the face of buffer overflow vulnerabilities.The new "Exec Shield" patch (which applies to the 2.4.21 release candidate kernel) takes several steps to fight buffer overflows, including:
- Engaging in some x86 segmentation magic to minimize the range of
addresses where the processor can execute code. This approach is
essentially a hack to work around the inconvenient fact that the x86
architecture lacks a page table flag for controlling execute
permission. By playing with segments, this patch makes it impossible
to execute code on the stack and in as much of the data area as
possible. As a result, the execution of exploit code delivered via
buffer overflows becomes far more difficult.
- As much executable code as possible is moved into the lowest part
of the virtual address space - below 16MB. Addresses in this range
begin with a zero byte, making them hard to create with purely ASCII
overflows. Many applications which deal with C strings cannot be
overflowed with a string containing NULL bytes. Others, of course,
will read any sort of data and will not be affected by this particular
change. For applications for which this measure is effective, however
(and that set includes most web-based applications), this shift into
the "ASCII armor" area will block exploits which work by jumping into
library code which might, say, execute a shell.
- A subsequent release of the patch includes shared library and stack address randomization. These measures make mass exploits harder, since each target process is different.
This approach, note, is different from that used in the recent OpenBSD 3.3 release. OpenBSD does not (yet) provide executable stack protection on the x86 architecture; instead, it relies on detecting buffer overflows with a modified compiler that installs (and checks) "canaries" on the stack. The OpenBSD "W^X" execute permission control will be extended to the x86 architecture in 3.4.
So does this approach bring any real security? Non-executable stack patches have failed to get into the Linux kernel before, since Linus does not believe in them:
The real solution, says Linus, is to fix the applications. That is undoubtedly true, but fixing all of the applications out there (and keeping them fixed) is not an easy task. In the meantime, raising the bar for potential attackers may well be the right thing to do. It would not be surprising to see this patch find its way into the kernels shipped by the major distributors, even if Linus does not accept it into the mainline.
OpenSSL pursuing FIPS 140-2 cryptographic certification
The Open Source Software Institute is leading an effort to secure National Institute of Standards and Technology's (NIST) FIPS 140-2 level 1 cryptographic certification for OpenSSL. Hewlett-Packard has provided funding to support the certification effort. In addition, Gary Gross, of HP, is serving as OSSI's program manager and technical lead for the FIPS 140-2 certification program. The press release is in PDF format. (Thanks to David A. Wheeler)
New vulnerabilities
epic4: buffer overflows and arbitrary code execution
| Package(s): | epic4 | CVE #(s): | |||||||||
| Created: | May 2, 2003 | Updated: | May 22, 2003 | ||||||||
| Description: | Timo Sirainen discovered several problems in EPIC4, a popular client for Internet Relay Chat (IRC). A malicious server could craft special reply strings, triggering the client to write beyond buffer boundaries. This could lead to a denial of service if the client only crashes, but may also lead to executing of arbitrary code under the user id of the chatting user. | ||||||||||
| Alerts: |
| ||||||||||
fuzz: symlink vulnerability
| Package(s): | fuzz | CVE #(s): | |||||
| Created: | May 7, 2003 | Updated: | May 7, 2003 | ||||
| Description: | The fuzz software stress testing tool has a temporary file vulnerability which can be exploited by a local attacker. | ||||||
| Alerts: |
| ||||||
leksbot: improper setuid-root execution
| Package(s): | leksbot | CVE #(s): | |||||
| Created: | May 6, 2003 | Updated: | May 7, 2003 | ||||
| Description: | Maurice Massar discovered that, due to a packaging error, the program /usr/bin/KATAXWR was inadvertently installed setuid root. This program was not designed to run setuid, and contained multiple vulnerabilities which could be exploited to gain root privileges. | ||||||
| Alerts: |
| ||||||
mod_auth_any: remote exploit
| Package(s): | mod_auth_any | CVE #(s): | CAN-2003-0084 | ||||
| Created: | May 2, 2003 | Updated: | May 7, 2003 | ||||
| Description: | mod_auth_any is a web server module that allows the Apache httpd server to
call arbitrary external programs to verify user passwords.
Vulnerabilities have been found in the way mod_auth_any escapes shell arguments when calling external programs. These vulnerabilities allow remote attackers to run arbitrary commands as the user under which the Web server is running. | ||||||
| Alerts: |
| ||||||
openssh: timing attack leads to information disclosure
| Package(s): | openssh | CVE #(s): | CAN-2003-0190 | ||||||||||||||||||||
| Created: | May 2, 2003 | Updated: | November 30, 2004 | ||||||||||||||||||||
| Description: | From the advisory:
"During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation." | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
Resources
The top 75 security tools
Insecure.org has put together a list of the top 75 security tools as determined by a poll of nmap users. The list starts out with the obvious entries (nessus, ethereal, snort), but there's sure to be something new there for just about anybody.Linux Security Week
The May 5 issue of the Linux Security Week newsletter from LinuxSecurity.com is available.
Events
HiverCon 2003 call for papers
HiverCon 2003 is happening November 6 and 7 in Dublin; the call for papers has gone out, with submissions due by the beginning of August.ToorCon 2003 call for papers
The call for papers for ToorCon 2003 (September 26 to 28, San Diego) has gone out; submissions are due by August 17.
Page editor: Jonathan Corbet
Next page:
Kernel development>>