Security

Linux security in 2003

Here in the free software world, we had no shortage of security problems in 2003. Vulnerabilities were announced in many packages, including (but not limited to) apache (several), balsa, bind, bugzilla, cdrecord, cfengine, cron, cups, cvs, ethereal (many), evolution, exim, fetchmail (many), fileutils, gdm, ghostscript, glibc, gnupg, gzip, hylafax, inetd, iproute, KDE, kerberos, kernel (several), lprng, lsh, lynx, mailman, man, mozilla, mpg123, mplayer, mutt, MySQL, openssh, openssl (several), perl, pine, PHP, postfix, PostgreSQL, proftpd, python, rsync, samba, screen, sendmail, snort, stunnel, sudo, tcpdump, vim, webmin, wget, wu-ftpd, xchat, XFree86, xinetd, xpdf, and zlib. All told, 304 entries were added to LWN's vulnerability database in 2003. Needless to say, that is far too many - and it does not count all of the problems which were silently fixed without going though a security alert process. As a community, we have to strive to do better in 2004. For all that we believe Linux and free software are more secure, there is no doubt that they are not, yet, secure enough.

The truly worrisome security trend in 2003, however, is the increasing level of attacks on the community's infrastructure. Servers were compromised at the GNU Project (twice) and the Debian Project (multiple servers in one incident). A mirror server for the Gentoo distribution was also broken into. There was also a compromise of the kernel's CVS server and an attempt to insert a trojan horse into the kernel itself. None of these attacks ended up with compromised code being made available to users, but most of them could have been exploited in that way.

Maybe these are all just random attacks (though an attempt to trojan the kernel can only be so random), or maybe somebody is making an attempt to mess with the server structure which holds this community together. Either way, chances are that, eventually, one of these attacks will succeed in causing serious damage, far beyond the service disruptions and lost time we have seen so far. The real lesson from 2003 is that there really are people out there with evil intent, and they are looking our way.

Comments (1 posted)

ethereal: protocol dissector and other vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2003-0925 CAN-2003-0926 CAN-2003-0927 CAN-2003-1012 CAN-2003-1013
Created:	December 19, 2003	Updated:	February 13, 2004
Description:	Serious issues have been discovered in two ethereal protocol dissectors. Both vulnerabilities will make the Ethereal application crash. The Q.931 vulnerability also affects Tethereal. It is not known if either vulnerability can be used to make Ethereal or Tethereal run arbitrary code. (CAN-2003-1012 and CAN-2003-1013)
Alerts:	Whitebox WBSA-2004:002-01 Ethereal 2004-02-12 Fedora-Legacy FLSA:1193 ethereal 2004-01-31 Red Hat RHSA-2004:002-01 ethereal 2004-01-05 Mandrake MDKSA-2004:002 ethereal 2004-01-13 Conectiva CLA-2004:801 ethereal 2004-01-07 Red Hat RHSA-2004:001-01 ethereal 2004-01-07 Debian DSA-407-1 ethereal 2004-01-05 Fedora FEDORA-2003-040 ethereal 2003-12-18

Comments (none posted)

irssi: remote denial of service

Package(s):	irssi	CVE #(s):
Created:	December 23, 2003	Updated:	December 23, 2003
Description:	Versions of irssi prior to 0.8.9 have a remotely exploitable denial of service vulnerability - but only on non-x86 systems.
Alerts:	Mandrake MDKSA-2003:117 irssi 2003-12-18

Comments (none posted)