Posted on 01/10/2004 12:20:46 PM PST by Bush2000
Flaws raise red flag on Linux security
But many users remain confident about the security of the open-source environment
Story by Jaikumar Vijayan
JANUARY 09, 2004 ( COMPUTERWORLD ) - A report earlier this week about a critical flaw in the Linux kernel was the latest in a series of recently discovered security problems with the popular open-source operating system. But many users were unfazed by the report and said Linux remains a solid and secure environment for running enterprise applications.
Poland-based iSec Security Research on Monday said it had found a critical flaw in a function used to manage virtual memory on Linux systems (see story). The flaw affects the 2.2, 2.4 and 2.6 versions of the Linux kernel, according to iSec.
The vulnerability could allow attackers to take administrative control of compromised systems and run attack code of their choice, an iSec advisory stated. ISec claimed that it had developed and successfully tested code that was capable of exploiting the flaw, although it added that actually launching such an attack wouldn't be easy.
The news follows the discovery of a similar flaw in the Linux 2.4 kernel last fall. In November, unknown attackers used that flaw to take down several servers belonging to the Debian Project, which produces a noncommercial Linux distribution. And last month, an attack on the Gentoo Linux Project compromised a server that was being used to download copies of Gentoo's Linux source code by users.
The rise in such incidents can be attributed to Linux's growing popularity, which makes it a more attractive target for malicious attackers, said David Wreski, CEO of Linux security vendor Guardian Digital Inc. in Allendale, N.J.
"The underground hacker community is very interested in Linux as a potential target," he said. "Because of the accessibility of the source code to everyone, it provides an equal opportunity for malicious attackers to find vulnerabilities and ways to exploit them."
Even so, Linux remains a secure environment, said John Cahill, senior network security engineer at Piedmont Natural Gas in Charlotte, N.C.
"I would say it is more secure than Microsoft and other environments because the code is looked over by so many people and it's so widely available that any vulnerabilities can be quickly identified and patched," Cahill said. Piedmont uses Linux for several e-mail-related functions and is considering its use for antispam purposes.
"There's not very much we've needed to do to secure Linux [applications]," said Joe Poole, manager for technical support at Boscov's Department Stores LLC in Reading, Pa. The company runs several virtual Linux servers on its mainframes that are protected by network and internal firewalls. All nonessential services, such as file transfers and Telnet, have been disabled. But there has been no need for the kind of constant patching and maintenance required for Windows, Poole said.
Linux distributors in general are also doing a better job of shipping products that have nonessential services disabled by default, said Paul Schmel, adjunct information security officer at the University of Texas at Dallas.
"The biggest plus that Linux has is that it's designed to allow users to be users and not administrators," Schmel said. "What Linux has that Windows doesn't have is ease of configuration from an administrator's standpoint. Stopping and starting services, configuring services to only respond on certain ports and interfaces is dramatically easier than it is with Windows."
This is the "can 50,000,000 Frenchmen be wrong?" school of argument. The answer to this is "Yes, they can."
Microsoft put resources into fixing the problem . . .
You can actually admit that Windows HAD a problem. Good, now let's move on to "Windows HAS problems."
BS. There's nothing wrong with the design of Windows. If Linux users were to run as administrator and execute unsafe code, they would be infected with the same worms, viruses, and trojans.
But it DOESN'T, Bush, and it ISN'T... and Windows DOES and IS. That is one of the major points that makes them more secure than Windows.
There is no reason to have the disclaimer unless such things were not included. You're reaching here.
BTW, as a Windows zealot, the fact that Mac OS X Server had only one vulnerability in that entire timeframe must get on your nerves. Face it, Windows as opposed to either Mac or Linux is both more expensive and more vulnerable.
"The rise in such incidents can be attributed to Linux's growing popularity, which makes it a more attractive target for malicious attackers"Linux is already more popular in the server world, and didn't make many inroads on the desktop last year, so that doesn't make much sense.
Why wait until Microsoft "innovates" and steal it? Linux should just go directly to the source of Microsoft's innovation -- Apple.
Yeah, I remember. I just hope we don't have to explain to him again how administrator privileges in Mac (or Linux) != administrator privileges in Windows and how that relates to security.
If you are too lazy to read the certs that does not make it BS it just makes you lazy...
I think so too. From what I've read of XP SP2, MS is rewriting its entire RPC system to slow the tide of vulnerabilities based on the current system's atrocious bounds checking. SP2 will contain a chunk of the rewrite. Maybe then they'll finally be able to go a month without a security update -- December was supposed to be the first month they did that but they had a couple anyway.
Practically nobody on your side talks about stability anymore.
They've made some great strides on the desktop. My XP system only freaks out once or twice a week with normal use, which is much better than 98 or 2000. But with servers, Windows still can't touch Linux or BSD for continuous uptime.
There's nothing wrong with the design of Windows
To begin with, there are the DLLs which cause conflict and require reboots after updates (say hello to downtime). Then there's the lack of the Unix equivalent of the separation of Administrator and Root so if you want to do anything, you're running with more privileges than you need. Then you have various installers that turn on services previously turned off.
If Linux users were to run as administrator and execute unsafe code, they would be infected with the same worms, viruses, and trojans.
You've forgotten already? Linux users often run as administrator, but still aren't vulnerable to many exploits. This is because administrator in Linux doesn't have the total system control that administrator in Windows does. This is one of the architectural flaws in Windows.
Gunslingr3 wrote:This particular flaw in the VM system is described at http://isec.pl/vulnerabilities/isec-0013-mremap.txt.
Do you know of an article that actually details the flaw and how it can be exploited?
That doesn't really detail the vulnerability or the exploit, only the underlying flaw in the virtual memory remap routine tha allows an exploit.
To exploit this flaw, you need to have access to a user account on the target machine, and a way to compile programs for execution on the target machine (you could compile them elsewhere and transfer them to the target machine, though). If you have that, and you sucessfully exploit the somewhat unpredictable behavior of the VM system, you can under some circumstances execute code of your own choosing at the kernel level, possibly granting yourself root access or doing other things that are beyond what is allowed your acccount's access privileges.
By itself, this is a pretty limited vulnerability. To exploit this vulnerability, an attacker would have to use other means to gain access to a user account on the target machine before the attacker could launch an attack.
I can't provide it because they didn't provide the details of the methodology. All we can go off is why did they put a disclaimer there? Should I take my five year old to a movie with a disclaimer of "May contain scenes of graphic violence and nudity"? There was a "may" so there's still a chance the movie is G rated, right? Total BS.
Yes it is. They could have administrator and root like with Linux and Mac. 99%+ of Mac users don't even know root exists, yet they can do everything they generally need to do with their computers.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.