Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems BSD

OpenBSD Vulnerabilty 55

Posted by timothy from the pretty-damn-obscure dept.
*no comment* writes "Normally vulnerability reports on slashdot wouldn't make it because there are so many. This one however is for the normally very secure OpenBSD. Someone can crash an OpenBSD bridge using a newly discovered ICMP exploit. More can be read here. This shouldn't affect most people as this only affects people that use OBSD as a bridge."
This discussion has been archived. No new comments can be posted.

OpenBSD Vulnerabilty More

OpenBSD Vulnerabilty

Comments Filter:

  • Can't get to openbsd.org (Score:3, Funny)

    by dtfinch ( 661405 ) * on Saturday August 28, 2004 @03:25PM (#10098181) Journal
    slashdotted already?

    Obligatory "No remote exploits in 0 days."

  • Still not really news (Score:4, Interesting)

    by pilybaby ( 638883 ) on Saturday August 28, 2004 @03:25PM (#10098183)
    Normally vulnerability reports on slashdot wouldn't make it because there are so many

    This might be unusual but it's really not that big a news. I suppose it shows that even the best are not infallible. Nice to see it's already been patched =).

  • Are you kidding me? (Score:2, Insightful)

    by Anonymous Coward
    Normally vulnerability reports on slashdot wouldn't make it because there are so many.

    That is, unless it's a vulnerability in Microsoft software.

    • Re:Are you kidding me? (Score:4, Informative)

      by Mark_MF-WN ( 678030 ) on Saturday August 28, 2004 @06:39PM (#10099422)
      It's only a big deal with Microsoft because the vulnerabilities in Microsoft software are typically quite severe and affect almost everyone.

      • Re:Are you kidding me? (Score:2, Interesting)

        by merdark ( 550117 )
        Funny, I haven't been affected by even one microsoft vulnerability. I think slashdot overinflates the microsoft vulnerabilities.

        The biggest microsoft vulnerability is the users. You could simply put up a page with instructions on how to install a backdoor prgram and many clueless users would go right ahead and do it so long as you promised great riches.

        The only reason slashdot makes a big deal about microsoft vulnerabilities is because slashdot is pro linux and anit-microsoft. You want proof that slashdot

        • Re:Are you kidding me? (Score:4, Insightful)

          by Mark_MF-WN ( 678030 ) on Sunday August 29, 2004 @03:15AM (#10101299)
          I didn't realize that you were "most people". You think just because YOU haven't been affected by Microsoft vulnerabilities, that most other Windows users haven't been as well? That's an invalid generalization if there ever was one.


          Slashdot is anti-microsoft for a reason -- Microsoft software is technologically inferior. It has way too many severe vulnerabilities. Without a firewall, a fresh Windows 2000 installation will have a worm within a minute of connecting to the internet. And that's without ever opening a single application. No other operating system EVER MADE can compare to that.


          No matter what fantasy world you live in, you cannot argue that Windows is not horrifically insecure.

          • Without a firewall, a fresh Windows 2000 installation will have a worm within a minute of connecting to the internet. And that's without ever opening a single application. No other operating system EVER MADE can compare to that.

            Except for Windows XP. ; )

          • I didn't realize that you were "most people". You think just because YOU haven't been affected by Microsoft vulnerabilities, that most other Windows users haven't been as well? That's an invalid generalization if there ever was one.

            Notice I never said that most windows users have not been affected by a vulnerability? Notice that I said *I* have never been affected? Not being affected has a lot to do with knowing how to secure computer systems and avoid installing suspect software.
            I do not disagree that th

            • Airplanes used to have very little security, and people would even smoke on them. Cars originally had no seat belts, and even when they did, wearing them was not mandatory for the longest time. Moterbike riders didn't used to wear, or have to wear, helments. These are all absurd things *now*, but at the time people did not realize it.

              I know that this is completely offtopic...but I find our seatbelt and helmet laws patently absurd. Your example here is poor, since your view is not universally accepted.

              • Well, I don't necessarily agree that people should be FORCED to protect themselves. I was using the seatbelt example more as in "we didn't know how important they are" and hence didn't wear them.
                • Well, I don't necessarily agree that people should be FORCED to protect themselves. I was using the seatbelt example more as in "we didn't know how important they are" and hence didn't wear them.

                  Right on, I'm with you. My post was pretty far off topic and in hindsight...I probably should have kept my mouth shut.

                  Cheers!

              • I know that this is completely offtopic...but I find our seatbelt and helmet laws patently absurd. Your example here is poor, since your view is not universally accepted. It comes down to the argument of who owns your body -- you or the goverment.
                [Equally OT. Sosumi.] I'd be happy to waive your obligation to use a helmet or a seatbelt if you'd waive all right to draw on public resources for medical treatment after an incident in which those devices are relevant.

          • Re:Are you kidding me? (Score:5, Insightful)

            by NutscrapeSucks ( 446616 ) on Sunday August 29, 2004 @12:48PM (#10103238)
            > No other operating system EVER MADE can compare to that.

            Except RedHat Linux 5.x and 6.x.

            The RH releases from the same era as W2K had dozens of remote holes in the install and had serveral worms targetting them, a long with lots of script kiddie activity. A study showed that an unpatched RedHat box would be owned in in a mean time of less than 5 minutes. Someone even made t-shirts that said "My other computer is your Linux box."

            (However, like Win2000, a RH box could be secured by a competant administrator.)

            Trying to judge technological inferiority by bug counts is inane, especially because Unix/Linux doesn't really have a significantly better record than Microsoft. (Compare the record of IIS6 versus Apache over the last year or so, for example...) So I would rephrase your statement: Slashdot is anti-microsoft for a reason -- Slashdot believes their shit don't stink
            • Clearly the parent has been in the security or networking business for more than a few years.

              In fact, I recall when RH7.0 came out and was followed almost immediately by 7.1 because of so many remote holes. I've seen several friends have their Linux boxes rooted, and I'm moderator on a Linux forum where we get at least one person a week (some times one a day) asking how they can repair their system because it was cracked.

              On the other hand, none of my OpenBSD boxes have ever been cracked... come to think
              • strange, I've used redhat since 5.0 and have never been rooted. I guess some folks just don't realize that you should secure your machine before connecting it to an unsecure network.
                • The biggest problem is that both Old RedHat and Old Windows automatically started many services right after install. When you're talking about a window of only few minutes before you're cracked, that's not good even if the administrator realizes he needs to reconfigure and patch.
                • None of my Windows boxes have ever been rooted, either. What's your point? You can secure any OS, so what's really important is the default state. Someone who immediately connects a box with Red Hat to a network will get rooted just as fast as someone who connects a default install of Win2K.

        • Re:Are you kidding me? (Score:2, Insightful)

          by javax ( 598925 )
          "I haven't been affected by even one microsoft vulnerability"

          Think this should be "I haven't yet noticed of being affected by even one"

        • Re:Are you kidding me? (Score:5, Insightful)

          by Lars T. ( 470328 ) <Lars.TraegerNO@SPAMgooglemail.com> on Sunday August 29, 2004 @09:50AM (#10102275) Journal
          Funny, I haven't been affected by even one microsoft vulnerability.

          You may actually think so, but you probably have. Had to wait for a product you ordered because a company involved in making or shipping it was hit by a mail worm? Had a slower internet "experience" because of Blaster? Get more Spam via distributed Spam relays installed by a worm? And I'm not even counting things like not being able to get cash at the ATM because it BSODed because that's not a vulnerability.

    • Exactly how is this insightful? If the pictures of Gates made up to look like a Borg are not enough of a clue then all the open source links at the top of the page should be. Is it possible people still come to this site and feel sorry for MS because they are "picked on" here?

  • Why'zit a 'Reliability' fix, not a 'Security' fix? (Score:2, Interesting)

    by Anonymous Coward
    Here:

    http://openbsd.org/errata.html

    "All architectures

    016: RELIABILITY FIX: August 26, 2004

    As reported by Vafa Izadinia bridge(4)
    with IPsec processing enabled can be crashed
    remotely by a single ICMP echo traversing the
    bridge.

    A source code patch exists which remedies this problem.

    015: RELIABILITY FIX: August 25, 2004

    Improved verification of ICMP errors
    in order to minimize the impact of ICMP attacks
    against TCP.

    http://www.ietf.org/internet-drafts/draft-gont- i cm p-payload-00.txt

    A source code patch

  • OpenBSD ICMP vulnerability obviously bogus (Score:4, Funny)

    by SlashCrunchPop ( 699733 ) on Saturday August 28, 2004 @07:55PM (#10099810)
    11:55:01 <Theo> For the last time, there is no ICMP vulnerability, period!!!
    11:55:08 <Niels> OK, man, whatever you say. So who submitted the bug report in the first place?
    11:56:23 <Theo> Who cares? It's B-O-G-U-S! Now leave me alone, can't you see I'm busy?! 11:56:29 <Niels> Jeez, would it kill you to give me the details on this alleged bug?
    11:59:51 <Niels> Theo? Are you there, man?
    ^An
    citi:~> ping -P "out ipsec ah/transport/10.0.1.1-10.0.2.2/use esp/tunnel/10.0.1.1-10.0.1.2/require" 10.0.2.2
    PING zeus.theos.com (10.0.2.2): 56 data bytes
    ^C
    --- 10.0.2.2 ping statistics ---
    3 packets transmitted, 0 packets received, 100% packet loss
    citi:~>
    ^Ap
    12:00:00 *** Signoff: Theo (Read error: EOF from client)
    /.
    ^^ typed in shock in an attempt to do a /whowas Theo

Slashdot Top Deals

Single tasking: Just Say No.

Close