Security
Brief items
A different kind of bad week
Another week, another email worm. Your editor initially wondered how he had managed to get put on a Microsoft security mailing list, but it didn't take too long to figure out what was really going on. A quick tweak to a SpamAssassin rule made the visible part of the problem go away; after all, very few messages of interest contain Microsoft executables anyway. But, of course, the "Swen" worm continues to chew up bandwidth.Swen seems to have two ways of attacking a system:
- a
two-year-old Internet Explorer bug, which allows code execution
through malicious HTML mail.
- Convincing users to run the attached executable.
As we have warned many times in this space, Linux is not immune to worms and viruses. We will almost certainly have a bad security day sooner or later. But Swen is a classic Microsoft worm, and, perhaps, Linux users have the right to feel just a little smug.
Exposed Linux systems with two-year-old vulnerabilities are rare. Fixing problems is sufficiently easy, and Linux administrators are sufficiently aware that vulnerabilities tend to be closed quickly. Keeping patching levels high as Linux expands into more desktop and consumer-oriented uses will be a challenge, however. We have all the tools we need to keep such systems current; it's mostly a matter of ensuring that those tools get used.
Imagine, however, that a widespread bug exists which, when exploited, could allow the running of arbitrary code from malicious email. The variety of mail user agents in the Linux world will restrict any such exploit to a fraction of the deployed Linux systems. The number of distributions in use will also make a universal exploit difficult. But, even if the attacker succeeds in running code on a target system, that code will be unable to kill the system's defensive processes, make "registry" (i.e. configuration file) changes, or engage in most of the other unpleasant activities carried out by Swen. To obtain that level of access to the system, the exploit code would have to find and take advantage of another, different vulnerability.
Then, there is the issue of convincing users to run a malicious executable sent to them in the mail. One of the real strengths of the Linux development model is that it is highly unlikely to result in the creation of mail utilities which allow the direct execution of programs received as email attachments. Any developer or distributor who tried to release a tool with that sort of vulnerability would not soon forget the reception they would get on the net. There is simply no excuse for extending such trust to the world as a whole. A Linux utility that was so trusting would be fixed within hours. Microsoft systems have remained vulnerable - in the face of overwhelming proof of the damage caused - for years.
Linux systems suffer from a constant stream of vulnerabilities, like other systems out there. The real difference, perhaps, is that our problems get fixed - almost always before they ever reach a point where they can be widely exploited. As a happy result, it is, once again, not Linux systems which are spamming the net with worm-laden email.
New vulnerabilities
gopherd: buffer overflow
| Package(s): | gopher | CVE #(s): | CAN-2003-0805 | ||||
| Created: | September 24, 2003 | Updated: | September 24, 2003 | ||||
| Description: | The University of Minnesota gopherd daemon has a set of remotely exploitable buffer overflows which can allow an attacker to execute code as the "gopher" user. Both remaining gopher servers are advised to upgrade in the near future. | ||||||
| Alerts: |
| ||||||
hztty: buffer overflow vulnerability
| Package(s): | hztty | CVE #(s): | CAN-2003-0783 | ||||
| Created: | September 24, 2003 | Updated: | September 24, 2003 | ||||
| Description: | hztty (a program for translating Chinese character encodings) has a pair of buffer overflow vulnerabilities which can be exploited by a local attacker. This problem is compounded on Debian systems by the fact that hztty is (unnecessarily) installed setuid root. Version 2.0-6 has the fix. | ||||||
| Alerts: |
| ||||||
ipmasq: insecure packet filtering rules
| Package(s): | ipmasq | CVE #(s): | CAN-2003-0785 | ||||
| Created: | September 22, 2003 | Updated: | September 24, 2003 | ||||
| Description: | ipmasq is a package which simplifies configuration of Linux IP masquerading, a form of network address translation which allows a number of hosts to share a single public IP address. Due to use of certain improper filtering rules, traffic arriving on the external interface addressed for an internal host would be forwarded, regardless of whether it was associated with an established connection. This vulnerability could be exploited by an attacker capable of forwarding IP traffic with an arbitrary destination address to the external interface of a system with ipmasq installed. | ||||||
| Alerts: |
| ||||||
openssh: multilple PAM vulnerabilities in Portable OpenSSH versions 3.7p1 and 3.7.1p1
| Package(s): | openssh | CVE #(s): | |||||||||||||||||
| Created: | September 23, 2003 | Updated: | October 1, 2003 | ||||||||||||||||
| Description: | Portable OpenSSH versions 3.7p1 and 3.7.1p1 contain multiple vulnerabilities in the new PAM code. At least one of these bugs is remotely exploitable (under a non-standard configuration, with privsep disabled). See this advisory for details. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
proftpd: remote root shell
| Package(s): | proftpd | CVE #(s): | CAN-2003-0831 | ||||||||||||||||||||||||||||
| Created: | September 24, 2003 | Updated: | January 2, 2004 | ||||||||||||||||||||||||||||
| Description: | The ASCII translation mechanism in ProFTPD 1.2.8 contains a vulnerability which will provide a remote attacker with a root shell - if the attacker is able to download a specially-crafted file. See this ISS advisory for more information. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
Resources
Monopolies and security
The Computer & Communications Industry Association has published a paper (available in PDF format) titled "CyberInsecurity: The Cost of Monopoly." This paper, written by Dan Geer, Rebecca Bace, Peter Gutmann, Perry Metzger, Charles Pfleeger, John Quarterman, and Bruce Schneier, makes the claim that software monocultures are hazardous to the security of the net as a whole. When one system is vulnerable, all systems are vulnerable. The authors also take Microsoft to task for its efforts to maintain and strengthen its monopoly, and for its poor security record. Suggestions in the paper include forcing Microsoft to make Office available for Linux and other operating systems.
Page editor: Jonathan Corbet
Next page:
Kernel development>>