Security
The future of vendor-sec
There is a certain amount of irony in the news that the vendor-sec mailing list—along with the server that distributes it—was compromised. Vendor-sec is the closed mailing list that is used by developers of Linux distributions along with members of the BSD development community ("vendors" by some definition) to discuss security problems before they are made public. So a compromise of the mailing list could easily lead to security issues made "public" well before fixes were available—an attacker's dream scenario.
How exactly the server was compromised is not clear, but a short time
after the announcement of the server
compromise and closing the backdoor that was being used, the attacker
returned. Vendor-sec moderator Marcus Meissner reported some five hours later that
"the attacker read this [the announcement]
and reentered the lst.de machine, went amok and destroyed the machine's
installation. The machine has now been shutdown.
". The break-in
was noticed a week or so before the announcement, which seems like somewhat
tardy notice to those who might be posting to vendor-sec, but, worse yet,
the best guess for when the original break-in occurred is January
20—more than a month earlier.
During that time—possibly longer—the attacker could have been reading the "secret" traffic on the list. Vendor-sec is nominally used to coordinate response between the participants, and to embargo information about the vulnerabilities until all are ready with a fix. Obviously, an embargo is not likely to be observed by an attacker. But it's certainly not at all clear that vendor-sec was leakproof prior to the break-in.
According to Meissner's announcement, there are 80-100 people signed up for vendor-sec, so expecting that there are no leaks may be overly optimistic. Even if all of the participants maintain the secrecy, though, the messages were sent in the clear so they could be intercepted along the way, dug out of inboxes by system administrators, or snagged from unattended mail clients. Since at least January 20, of course, someone didn't even need to do any of those, which started Meissner thinking about whether a closed list like vendor-sec is even really needed any more, and if it is, what changes might need to be made. So he threw that out for discussion.
The consensus seems to be that there is value in the closed list, but that leaks should probably be expected—hopefully not from attackers, but via list members by mistake, inattention, or, possibly, malfeasance. Meissner has asked Alexander Peslyak (aka Solar Designer), who runs the oss-security list and is the leader of the Openwall Linux distribution, to take over vendor-sec, and part of that might mean that the messages start being encrypted with GPG. That would stop some of the potential leak sources, but obviously not all. But there were also questions about whether the list should be split up and, if so, how.
Solar Designer suggested splitting the list
up into three different lists, one each for Linux, BSD, and security
researchers. The idea would be that subscribers would get less mail that
isn't relevant to their interest area, but others thought that was
unnecessarily complicating things. As Eugene Teo put it: "I think it is more
effective to have just one mailing list like before that everyone can
remember.
"
There is discussion of having oCERT (Open Source Computer Emergency Response Team) host a vendor-sec-style mailing list. oCERT already has verified contacts that could be used to disseminate non-public security information to various projects as needed. Andrea Barisani, oCERT project coordinator is open to such an arrangement, though it would likely require more team members to handle the workload. It could turn into a lot of additional work as Barisani describes:
I think we can continue to do this for selected cases but it would be hard to scale enough to support this "tailored" approach for every single report if we expand our visibility, additionally I think everyone would favour less extra process as pointed out already.
So far, no real decisions have been made. Some kind of vendor-sec list seems to be useful, but whether it stays a single list, and where and how it will be hosted are up in the air. Even though few are arguing that vendor-sec should go away, there was some interesting data from Mark J. Cox about the trends of reports to vendor-sec. Over time, it would seem that the number of issues being reported first to vendor-sec have dropped significantly.
Cox keeps track of how the Red Hat security team first finds out about
vulnerabilities, and the data suggests that the importance of vendor-sec
for that purpose is diminishing. In 2008, 69 issues were found first on
vendor-sec, but by 2010
that had dropped to 29. According to Cox, 29 represents just 4% of the
total number of vulnerabilities fixed. In addition, the severity level of
those problems first reported to vendor-sec were not as high as some expected: "Of the flaws we rated impact critical or with a
CVSS [Common Vulnerability Scoring System] of 'high', only 4 were from that 29 from vendor-sec.
"
There may come a time when vendor-sec (or whatever it becomes) is no longer needed, but we seemingly haven't reached that point yet. There are times when coordinating a fix (and establishing a CRD, coordinated release date) is important to protect end-users from severe, non-public vulnerabilities. While "full disclosure" is preferred by some, others are sold on "responsible disclosure"; as long as that's the case, lists like vendor-sec will need to be available to help orchestrate those releases.
Brief items
Security quotes of the week
An Android security update from Google
Google has posted an advisory on the recent malware distributed through the Android market and how the company is responding. "We are pushing an Android Market security update to all affected devices that undoes the exploits to prevent the attacker(s) from accessing any more information from affected devices." It's worth noting that the exploit used known vulnerabilities in older versions of Android; there is little in the advisory about closing those holes before they are exploited.
Vendor-sec host compromised, shut down
The vendor-sec list is where distributors discuss security problems which have not yet been disclosed to the public. It turns out that the machine which hosts this list was compromised, probably in January, and any subsequent traffic was not as secret as participants may have hoped. Since the announcement, the machine has been totally vandalized by the attacker, and vendor-sec is down. The thread is interesting to read; much of it concerns whether the community still needs a closed list like vendor-sec or not.
New vulnerabilities
dtc: multiple vulnerabilities
| Package(s): | dtc | CVE #(s): | CVE-2011-0434 CVE-2011-0435 CVE-2011-0436 CVE-2011-0437 | ||||
| Created: | March 3, 2011 | Updated: | March 9, 2011 | ||||
| Description: | From the Debian advisory: CVE-2011-0434: The bw_per_moth.php graph contains an SQL injection vulnerability. CVE-2011-0435: Insufficient checks in bw_per_month.php can lead to bandwidth usage information disclosure. CVE-2011-0436: After a registration, passwords are sent in cleartext email messages. CVE-2011-0437: Authenticated users could delete accounts using an obsolete interface which was incorrectly included in the package. | ||||||
| Alerts: |
| ||||||
kernel: privilege escalation
| Package(s): | linux-ec2 | CVE #(s): | CVE-2011-1044 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | March 3, 2011 | Updated: | August 9, 2011 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory: Dan Carpenter discovered that the Infiniband driver did not correctly handle certain requests. A local user could exploit this to crash the system or potentially gain root privileges. (CVE-2011-1044) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: multiple vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2010-4076 CVE-2010-4650 CVE-2011-0006 CVE-2011-0710 CVE-2011-0711 CVE-2011-0712 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | March 8, 2011 | Updated: | August 9, 2011 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the SUSE advisory:
CVE-2010-4076: The rs_ioctl function in drivers/char/amiserial.c in the Linux kernel did not properly initialize a certain structure member, which allowed local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call. CVE-2010-4650: Fixed a verify_ioctl overflow in "cuse" in the fuse filesystem. The code should only be called by root users though. CVE-2011-0006: Fixed a LSM bug in IMA (Integrity Measuring Architecture). IMA is not enabled in SUSE kernels, so we were not affected. CVE-2011-0710: The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel on the s390 platform allowed local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/. CVE-2011-0711: A stack memory information leak in the xfs FSGEOMETRY_V1 ioctl was fixed. CVE-2011-0712: Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel might have allowed attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2011-0714 | ||||
| Created: | March 9, 2011 | Updated: | March 9, 2011 | ||||
| Description: | The kernel's RPC server socket implementation contains a use-after-free flaw which can be exploited to cause a kernel oops. | ||||||
| Alerts: |
| ||||||
libcgroup: multiple vulnerabilities
| Package(s): | libcgroup | CVE #(s): | CVE-2011-1006 CVE-2011-1022 | ||||||||||||||||||||||||||||
| Created: | March 4, 2011 | Updated: | May 27, 2011 | ||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
A heap-based buffer overflow flaw was found in the way libcgroup converted a list of user-provided controllers for a particular task into an array of strings. A local attacker could use this flaw to escalate their privileges via a specially-crafted list of controllers. (CVE-2011-1006) It was discovered that libcgroup did not properly check the origin of Netlink messages. A local attacker could use this flaw to send crafted Netlink messages to the cgrulesengd daemon, causing it to put processes into one or more existing control groups, based on the attacker's choosing, possibly allowing the particular tasks to run with more resources (memory, CPU, etc.) than originally intended. (CVE-2011-1022) | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
libtiff: code execution
| Package(s): | libtiff | CVE #(s): | CVE-2011-0192 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | March 3, 2011 | Updated: | June 27, 2011 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory: A heap-based buffer overflow flaw was found in the way libtiff processed certain TIFF Internet Fax image files, compressed with the CCITT Group 4 compression algorithm. An attacker could use this flaw to create a specially-crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. (CVE-2011-0192) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
moin: cross-site scripting
| Package(s): | moin | CVE #(s): | CVE-2011-1058 | ||||||||||||||||||||
| Created: | March 7, 2011 | Updated: | October 10, 2011 | ||||||||||||||||||||
| Description: | From the CVE entry:
Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
moodle: multiple vulnerabilities
| Package(s): | moodle | CVE #(s): | |||||||||||||
| Created: | March 4, 2011 | Updated: | June 16, 2011 | ||||||||||||
| Description: | From the Moodle release notes:
| ||||||||||||||
| Alerts: |
| ||||||||||||||
proftpd: denial of service
| Package(s): | proftpd-dfsg proftpd | CVE #(s): | CVE-2011-1137 | ||||||||||||||||||||
| Created: | March 9, 2011 | Updated: | April 18, 2011 | ||||||||||||||||||||
| Description: | The proftpd FTP daemon suffers from an integer overflow in its SFTP module, enabling a denial of service attack. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
pywebdav: SQL injection
| Package(s): | pywebdav | CVE #(s): | CVE-2011-0432 | ||||||||||||
| Created: | March 3, 2011 | Updated: | March 10, 2011 | ||||||||||||
| Description: | From the Debian advisory: It was discovered that python-webdav, a WebDAV server implementation, contains several SQL injection vulnerabilities in the processing of user credentials. | ||||||||||||||
| Alerts: |
| ||||||||||||||
rubygem-actionpack: cross-site scripting/request forgery
| Package(s): | rubygem-actionpack | CVE #(s): | CVE-2011-0446 CVE-2011-0447 | ||||||||||||||||||||
| Created: | March 7, 2011 | Updated: | September 7, 2011 | ||||||||||||||||||||
| Description: | From the CVE entries:
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value. (CVE-2011-0446) Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696. (CVE-2011-0447) | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
scsi-target-utils: denial of service
| Package(s): | scsi-target-utils | CVE #(s): | CVE-2011-0001 | ||||||||||||||||||||||||||||
| Created: | March 9, 2011 | Updated: | July 12, 2011 | ||||||||||||||||||||||||||||
| Description: | The tgtd daemon in the scsi-target-utils package contains a double-free flaw which can be exploited to force a crash. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
seamonkey: arbitrary code execution
| Package(s): | iceape, seamonkey | CVE #(s): | CVE-2010-0056 | ||||||||||||||||
| Created: | March 4, 2011 | Updated: | March 21, 2011 | ||||||||||||||||
| Description: | From the Debian advisory:
Christian Holler discovered buffer overflows in the Javascript engine, which could allow the execution of arbitrary code. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
subversion: denial of service
| Package(s): | subversion | CVE #(s): | CVE-2011-0715 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | March 4, 2011 | Updated: | June 27, 2011 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Philip Martin discovered that HTTP-based Subversion servers crash when processing lock requests on repositories which support unauthenticated read access. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
texmacs: privilege escalation
| Package(s): | TeXmacs | CVE #(s): | CVE-2010-3394 | ||||||||||||
| Created: | March 7, 2011 | Updated: | January 27, 2014 | ||||||||||||
| Description: | From the CVE entry:
The (1) texmacs and (2) tm_mupad_help scripts in TeXmacs 1.0.7.4 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. | ||||||||||||||
| Alerts: |
| ||||||||||||||
tiff: arbitrary code execution
| Package(s): | libtiff | CVE #(s): | CVE-2011-0191 | ||||||||||||||||||||||||||||||||
| Created: | March 4, 2011 | Updated: | June 27, 2011 | ||||||||||||||||||||||||||||||||
| Description: | From the CVE entry:
Buffer overflow in LibTIFF in ImageIO in Apple iTunes before 10.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with JPEG encoding. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
wireshark: multiple DOS vulnerabilities
| Package(s): | wireshark | CVE #(s): | CVE-2011-1139 CVE-2011-1140 CVE-2011-1141 CVE-2011-1142 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | March 9, 2011 | Updated: | April 19, 2011 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | Wireshark suffers from denial-of-service vulnerabilities in its SMB, LDAP, and BER dissectors, and one which exploitable via a crafted pcap capture file. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>