Skip to comments.Major security flaw threatens Linux users
Posted on 03/05/2014 10:20:50 AM PST by ShadowAce
A source code mistake in the GnuTLS library an open-source software building block used in a large number of different Linux distributions to handle secure Internet connections could prove a serious threat to the privacy of Linux users, as developers rush to patch the vulnerability.
Nikos Mavrogiannopolous, the developer of GnuTLS, announced Monday in a mailing list message that he had implemented a fix to the source code that closes the loophole. The flaw would have enabled an attacker to spoof GnuTLS system for verifying certificates, exposing supposedly secure connections to stealthy eavesdropping.
By creating a specific type of fake certificate, an attacker could trick GnuTLS into accepting it as genuine, granting access to an otherwise-secure connection. This done, the intruder could monitor traffic flowing through the connection in plain text, and even interject code of his own, potentially opening further avenues of attack.
Mavrogiannopolous, who called the bug embarrassing, said that the issue was discovered during an audit performed on behalf of his employer, Red Hat. Some major Linux distributions have already acted to apply Mavrogiannopolous fix, according to a security advisory posted by LWN.net. Ubuntu, Debian, Fedora, Red Hat, Oracle, Slackware and SUSE have all rolled out updates aimed at closing the loophole.
The news comes days after Apple patched a similar issue in its own software, which had exposed iOS and OS X users to similar man-in-the-middle attacks. Thanks to the greater consumer reach of Apples products, that goto fail issue received widespread attention with some commentators even ascribing sinister motivations to Apples apparent sluggishness in fixing the flaws.
No doubt the “Mavrogiannopolous patch” will soon become a household name.
So, before it became a serious issue, a private developer fixed it and released the patch for free?
Is there supposed to be a downside to this?
Just letting people know....:D
The good news is that it’s fixed. The bad news is that you can’t download it unless you can spell “Mavrogiannopolous”.
Probably a good idea it was kept under wraps until AFTER the updates were sent out.
I wonder how this will affect many smartphones. Android sits on top of a Linux system.
Here is a little beta game available for Windows, Mac and Linux, runs perfectly on my dinosaur.
I like it
I’m assuming it’s the common spelling... ;-)
But Apple and Linux aren’t vulnerable, only Microsatan! Just shows to go ya it’s always something! bad people will always find a way to screw with us.
Darn. Probably time to upgrade Ubuntu. I am still running 10 because I hate the iphone style interface. Been an excellent OS for me otherwise.
This is the first time I have heard of an issue with Linux in 3 years. I am not current on the techie stuff, though.
Man, that’d make one heck of a root password. The problem is that I’d never get in either.
I really don’t have an issue with Apple or Linux, it’s just human nature that the more popular something is in use the more it draws the lowlifes to attack it.
Consider Linux Mint w Cinnamon desktop as an alternative. I hated the new interface too and found this a great option.
Its essentially Ubuntu with some tweaks.
Install your updates, people! Hope you weren’t thinking that it’s only necessary on Windows machines…
If you don’t like the Unity interface you can always try the Kubuntu or Xubuntu varieties. They are probably identical underneath the desktop.
I’d have migraines.
It’s being worked on, but I can see it as an absolutely huge undertaking
Considering how many flaws have been found in each OS, how long it takes for a patch to be found, and what happens once you patch them?
M$ has nothing to crow about here.
The article misspells the name. Should be ...poulos not ...polous.
Indeed it is, though if they're using C (or C++) they're making an inherently arduous task even more difficult for themselves.
Ada/SPARK would probably be ideal, as Ada lends itself to these sorts of analyses fairly well and it has good low-level facilities.
A functional language would be excellent for implementing a large portion of the OS w/ verifiable properties, but there are efficiency issues (as well as that they're rather unsuited to low-level manipulations).
IMO we need the fundamental/base portions of our SW to be formally verified: OS, Compiler, the basics of the networking components (like DNS). If that's done the stability/reliability/security of everyday consumer-level software should be immensely improved.
This article is obviously untrue. Linux and Apple products are completely immune from viruses. Only Microsoft products are affected by hackers.
This isn’t a virus.
Green Hills Integrity, for instance?
The worst thing about getting a virus on Linux or Apple is the fact that neither one of them has their act together with regard to fixing and distributing the hotfixes to end users.
Microsoft learned this lesson a long time ago and built an effective system for this. MS is hit more often but that comes with the territo0ry when you own about 90% of the OS market.
Correction, not a virus, agreed. Its a security flaw. In other words it doesn’t have to propagate to other machines, the hole is already in place and ready to go.
The ruling Kings were less than 1% of any given population.
Now ask yourself, how much of the Internet rests on Linux servers? How much of our power grid and communications networks run on Linux-based appliances?
Now even Google ChromeOS based devices are little more than a fancy front-end for a Linux backend.
A few things to think about...
Good instance // yep.
It's not really a consumer-level OS, though. (The Multivisor looks really interesting.)
No, but it shows bug-free software can be had instead of the garbage these hacker types produce.
Very true — a couple of academics [lit. 2] produced Ironsides, which is a verified DNS, as a proof of concept that formal-verification tools [SPARK's theorem prover] were ready to be used in full applications.
?? ping ??
Sweet! Thanks for that. I work in the DO-178C arena and know what it takes to build bug-free, safety critical systems. It isn’t easy because it is ‘old school’ where most programmers just want to code.
So...what package would a Mint 15 or 16 user install? An Ubuntu patch?
Look for a package by the name of gnutls or similar.
You're quite welcome.
I work in the DO-178C arena and know what it takes to build bug-free, safety critical systems. It isnt easy because it is old school where most programmers just want to code.
Tell me about it — in my last job I was doing the backend of a system dealing with medical/insurance records (in PHP) and wrote an importation module that took a CSV file as input, I would not be surprised if that module is not the best commented in that company's code-base. Anyway, after everything was up and running we pushed it over to the production machine where it promptly failed. Turns out that the dev machine had a newer version of PHP, which had a CSV-parsing function, and the production machine did not. So I wrote my own CSV-parsing function pushed that to production and everything worked great.
Talking with the other main dev on that project about it later I got the response "Why not just use string-split? Done." … This data being things like names (Last, First), Addresses, lists... IOW, a non-parsing method would be (and is) wholly inadequate for all but the most trivial CSV-files. *sigh*
This update was patched last week. I updated a bunch of my Ubuntu 12.04 servers over the weekend, and this patch was in it.
Hooray for open source and community awareness!
That 5th dimension trickster always shows up unexpectedly!
Funny lol. Oddly, I didn't get this update for SUSE last night. Will have to check which actual packages are involved. Called GnuTLS?
Thank you sir!