Remote Bug Found In Ubuntu Kerberos 93
Trailrunner7 writes "There's a remote vulnerability in the Kerberos implementation in several versions of Ubuntu, which could allow an attacker to cause a denial-of-service on vulnerable servers. The bug is in Ubuntu 8.04, Ubuntu 9.10, Ubuntu 10.04 and Ubuntu 10.10. The bug is in the Ubuntu implementation of the Kerberos authentication protocol. Ubuntu has released a slew of new packages to fix the flaw. The group said that in most cases, a normal system update will add the new fixes."
Re: (Score:1, Insightful)
Sometimes I have the feeling that kernel level programmers only disclose bugs which they are able to use to discredit a competitive colleague. The remainder of the exploits they quietly continue to use.
Consider: who would know?
Re: (Score:3)
If there is one thing that the world has in abundance, those are it.
Re: (Score:3, Informative)
Kerberos is not in the Linux Kernel.
Re: (Score:1)
Good point. Also, sadly, not going to get looked at very closely due to the glennbeckishness of it.
Re: (Score:3)
There are very few cases where any problems occur, even with large updates. I'm not quite confident enough to update versi
Re: (Score:2, Interesting)
Re:Responsible disclosure (Score:5, Informative)
The updates usually only fix things on disk and won't affect in-memory images of running executables.
post-install script: /sbin/service restart thing-i-just-fixed
Fortunately Linux doesn't have three zillion things running in the background that can't easily be restarted, unlike Windows.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
But X Windows and similar stuff can't be restarted without killing off all the GUI apps.
Sure, but:
a) exploits in the X server seem fairly rare.
b) most home users log out every day in any case.
Pretty much anything other than the X server or kernel can be restarted without having to log out. The kernel can be patched while running, but Ubuntu doesn't support it as far as I'm aware.
Re: (Score:1)
The kernel can be patched while running, but Ubuntu doesn't support it as far as I'm aware.
Yes it does. [ksplice.com]
Re:Responsible disclosure (Score:4, Insightful)
Fortunately Linux doesn't have three zillion things running in the background that can't easily be restarted, unlike Windows.
Quite right, because Windows doesn't have a restart option like Linux. You have to manually type it as
net stop "service" && net start "service"
That is so much harder.
Re: (Score:2)
Except every piece of crap program on Windows wants to run its own helper/updater/taskbar crap which can't trivially be restarted.
Not to mention that any time you want to update a system DLL you have to reboot because Windows is so backward that you can't replace them while the OS is running.
Re: (Score:2)
If you look in Windows Task Manager you can see the processes and services running on your computer. Helpers/updaters/taskbar icons don't appear magically on screen. They have corresponding entries in the task manager lists. If it is a service, then the net start/stop code that I posted will work fine. If it is a process, then you can kill it with the "End Task" option. You might claim that this is not trivial way of restarting, but then neither is having type type "/sbin/service restart thing-i-just-fixed"
Re: (Score:2)
If it is a service, then the net start/stop code that I posted will work fine. If it is a process, then you can kill it with the "End Task" option.
Except, of course, it won't be restarted -- it will remain in such state until you reboot or log in again (depending on what triggers the start). And nothing will happen with DLLs.
Re: (Score:2)
But this is starting to sound harder than a single command compared to Linux, isn't it now ;)
On the other hand, I don't recall ever having to issue this command after an update. The updates tend to handle it themselves. The ones that require reboots are a lot less common than they used to be.
Re: (Score:3)
Re: (Score:1)
google, or whatever.
ubuntu openssl security flaw, it was a Debian package.
I would have thought they would stop playing around patching that kind of stuff after the first cock-up.
"Security Warning: Serious flaw in Debian Linux OpenSSL Package
by Vivek Gite on May 13, 2008 3 comments
There is a serious security flaw in Debian openssl - the random number generator in Debian's openssl package is predictable. As a result, cryptographic key material may be guessable."
Dear MS trolls: (Score:3, Insightful)
Notice how this has already been patched before most of the world knew about it?
This is the difference in the GNU/Linux world and your world.
Love,
An ex-MS person that will never go back
Re: (Score:2, Interesting)
This difference is caused by the fact that hackers and malware programmers generally love GNU/Linux. Therefor they report the bug first, then disclose it to the public and never exploit it. For Windows bugs they do it exactly the other way around.
Re: (Score:1)
Re: (Score:2)
This difference is caused by the fact that hackers and malware programmers generally love GNU/Linux. Therefor they report the bug first, then disclose it to the public and never exploit it. For Windows bugs they do it exactly the other way around.
This is not the first time I've heard something like it, and I still don't understand it. How can all hackers and malware programmers "generally love" Linux so much that they don't attack Linux sites? Can this really be true? I don't see how, but for the sake of argument, assuming that statement is true, WHY would hackers and malware programmer loooovvvvvvvee Linux so much and not Microsoft that they protect Linux and attack Microsoft? Why?
Re: (Score:1)
Maybe because its easier to feel like Robbin Hood from their mom's basement while they're doing battle against the great Satan, Microsoft. They want their pet OS to have every advantage in making them feel superior to all the infidels who haven't been enlightened. But, do note, there's a difference between those who are capable of discovering and exploiting a memory corruption vulnerability by sifting through decompiled binaries, and dumb-ass kids who copy and paste SQL injections until one works with the
Re: (Score:2)
Windows is still the largest install base as well. For whatever reason OSX goes down quicker at Pwn2Own.
Re: (Score:1)
Re: (Score:2)
Which reminds me of someone who wrote a virus and accidentally infected themselves.
Re: (Score:2)
It's a big load of crap. It's exactly like saying armed robbers would report flaws in bank security because they love banks while knocking over gas stations, because they hate gas stations.
Re: (Score:2)
You think black hats have day jobs? Or that their own boxes aren't secured to the point that practically no flaw poses a serious threat?
Trolling the trolls: (Score:1)
Open sores? Can I have my Linux free of physical defects please?
Re: (Score:2)
Re:Dear MS trolls: (Score:4, Insightful)
It was discovered in (actually, discovered much earlier but acknowledged in) October 2010, thus the difference between the two worlds is that folks who discover Linux bugs tend not to share them with anyone but the vendor, and the folks who discover Windows bugs tells everyone and their dog, before even notifying Microsoft. Interestingly, often the same folks in both cases.
Thus, there's nothing wrong with our world. There's something wrong with the mindset of the white-hats.
Re: (Score:3, Informative)
Except that here back in reality we have multitudes of real, published news stories about the building animosity between MS and whitehats who try to disclose bugs that MS doesn't care about and/or recognize, or possibly just ignore until they get around to it. There's problem #1 with your argument.
Gosh, denial is a popular place (Score:5, Informative)
Except for the countless times that people have disclosed security problems to MS, found that MS didn't give a toss and finally after months release it to the public because if THEY know it, some one else might ALSO know it and be exploiting it.
But I guess a MS fanboy truly believes ignorance is bliss.
Re: (Score:3)
Re: (Score:3)
Security bugs?
Re: (Score:1)
In most projects, these are the bugs saying "make it more like Windows".
Re:Gosh, denial is a popular place (Score:5, Insightful)
Does your rant have any basis in reality?
I'm not used Mac OSX for any significant length of time, but have been using Windows and Linux for years. Plenty of Windows software breaks on updates and/or becomes abandonware when the vendor goes out of business or stops making drivers for the older hardware on newer versions. One of the reasons I shifted my home PC to Linux was to escape all that nonsense of stuff you'd bought just suddenly stopping working on upgrade. Or degrading over time unless you do a complete re-install. I've always found Linux with it's updates a breath of fresh air compared to the hassles of keeping Windows up and running. My hardware and peripherals keeps working through many OS updates, user facing software is updated frequently. I assure you that Linux users would definitely be upset if user facing programs suddenly stopped working on update, so that seems a bizarre distinction to make.
And billions of dollars of software does run on Linux, I know we've got millions of dollars worth of software running on Linux just where I'm working. And there is that choice between running the latest and greatest, for stable but behind the curve which strong support from vendors.
Microsoft tends to tie its wagons together, despite having separate server and consumer versions.
Re: (Score:2)
Ubuntu contains bleeding-edge software. It's the Fedora of Debian-based distros. If you don't want updates to break things, run Debian Stable.
Re: (Score:2)
Re: (Score:2)
It was patched quickly after languishing for almost three years.
Being patched quickly after only three years seems pretty good compared to the average Windows exploit.
Re: (Score:2)
It was patched quickly after languishing for almost three years.
Being patched quickly after only three years seems pretty good compared to the average Windows exploit.
After 17 days of demonstrations in XP, Egypt.
And what about that regression bug (Score:1)
Get off your high horse, it's too big for you.
Re: (Score:2)
OH MY GOD not you again.
Why do I cower? What am I afraid of? When I close my eyes I see your dumb ass asking what I'm cowering about.
Re: (Score:3)
Just asking (Score:2)
Re:Just asking (Score:5, Informative)
Re:Just asking (Score:5, Informative)
It is MIT Kerberos, so yes. This came out last week.
http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2011-002.txt [mit.edu]
ftfa (Score:5, Informative)
Kevin Longfellow and others discovered that the MIT krb5 Key Distribution Center (KDC) daemon is vulnerable to denial of service attacks when using an LDAP back end due to improper handling of network input.
certainly not a good thing, but this isn't a remote hole
Re: (Score:1)
Re: (Score:3)
Kerberos issue, Denial of Service, not critical (Score:5, Informative)
This is a Kerberos (server side) issue affecting vendors shipping Kerberos, not an Ubuntu specific issue. All 4 of the issues are denial of service only (which is bad for authentication infrastructure since you can basically prevent everyone from getting any work done). Nothing to get terribly worked up about.
http://www.mit.edu/afs/athena/astaff/project/kerberos/www/advisories/MITKRB5-SA-2011-001.txt [mit.edu]
http://www.mit.edu/afs/athena/astaff/project/kerberos/www/advisories/MITKRB5-SA-2011-002.txt [mit.edu]
No, it's Karmic, not Kerberos (Score:2)
That was my first thought, anyway. Silly letter-versions.
Update Manager has it (Score:2)
Just installed the patches. Nicely, nicely quickstuff.
Re: (Score:2)
I installed the patches before the article came out. Ubuntu has many failings, but time to first patch ain't one of them. Yes, I'm looking at you, Microsoft.
This is news? (Score:3, Informative)
Doesn't this happen all the time?
Slow News day.. (Score:1)