Fwd: [ PRIVACY Forum ] Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping
Oh hell. Is this the *same* bug that just broke in Apple code last week? Cheers, -- jra ----- Forwarded Message -----
From: "PRIVACY Forum mailing list" <privacy@vortex.com> To: privacy-list@vortex.com Sent: Tuesday, March 4, 2014 3:17:43 PM Subject: [ PRIVACY Forum ] Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping
http://j.mp/1jPcVOr (Ars Technica)
"Hundreds of open source packages, including the Red Hat, Ubuntu, and Debian distributions of Linux, are susceptible to attacks that circumvent the most widely used technology to prevent eavesdropping on the Internet, thanks to an extremely critical vulnerability in a widely used cryptographic code library. The bug in the GnuTLS library makes it trivial for attackers to bypass secure sockets layer (SSL) and Transport Layer Security (TLS) protections available on websites that depend on the open source package. Initial estimates included in Internet discussions such as this one indicate that more than 200 different operating systems or applications rely on GnuTLS to implement crucial SSL and TLS operations, but it wouldn't be surprising if the actual number is much higher. Web applications, e-mail programs, and other code that use the library are vulnerable to exploits that allow attackers monitoring connections to silently decode encrypted traffic passing between end users and servers. The bug is the result of commands in a section of the GnuTLS code that verify the authenticity of TLS certificates, which are often known simply as X509 certificates."
- - -
--Lauren-- Lauren Weinstein (lauren@vortex.com): http://www.vortex.com/lauren Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info Founder: - Network Neutrality Squad: http://www.nnsquad.org - PRIVACY Forum: http://www.vortex.com/privacy-info Member: ACM Committee on Computers and Public Policy Lauren's Blog: http://lauren.vortex.com Google+: http://google.com/+LaurenWeinstein Twitter: http://twitter.com/laurenweinstein Tel: +1 (818) 225-2800 / Skype: vortex.com _______________________________________________ privacy mailing list http://lists.vortex.com/mailman/listinfo/privacy
-- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274
On Tue, Mar 04, 2014 at 10:07:56PM -0500, Jay Ashworth wrote:
Oh hell.
Is this the *same* bug that just broke in Apple code last week?
I'd be surprised if Apple used GnuTLS, on licencing grounds...
widely used cryptographic code library. The bug in the GnuTLS library
On the other hand, the DSA does sound *awfully* familiar: http://www.debian.org/security/2014/dsa-2869 Looking at the patch included in the sid version referenced in that DSA (also available at https://www.gitorious.org/gnutls/gnutls/commit/6aa26f78150ccbdf0aec1878a41c1...), the general class of logic error involved is somewhat similar to the Apple case. Thankfully, we can see the full revision history of GnuTLS, and it looks like Nikos both fixed the bug *and* introduced it (at least, the 'goto cleanup' tests were introduced in 0fba2d90, way back in October 2003 -- it may have been safe then and someone else mucked up the cleanup code to break it; I haven't looked that deeply). Fun times indeed. "Once is happenstance, twice is coincidence..." - Matt
2014-03-05 7:17 GMT+01:00 Matt Palmer <mpalmer@hezmatt.org>:
the 'goto cleanup' tests were introduced in 0fba2d90, way back in October 2003
Where can you see that "the 'goto cleanup' tests were introduced in 0fba2d90, way back in October 2003" ? *María García*
On Wed, Mar 05, 2014 at 12:37:29PM +0100, María García wrote:
2014-03-05 7:17 GMT+01:00 Matt Palmer <mpalmer@hezmatt.org>:
the 'goto cleanup' tests were introduced in 0fba2d90, way back in October 2003
Where can you see that "the 'goto cleanup' tests were introduced in 0fba2d90, way back in October 2003" ?
In the git repo I linked to in my previous e-mail. - Matt -- I have always wished that my computer would be as easy to use as my telephone. My wish has come true. I no longer know how to use my telephone. -- Bjarne Stroustrup
I can't see the date... 😕 El mar 6, 2014 12:27 PM, "Matt Palmer" <mpalmer@hezmatt.org> escribió:
On Wed, Mar 05, 2014 at 12:37:29PM +0100, María García wrote:
2014-03-05 7:17 GMT+01:00 Matt Palmer <mpalmer@hezmatt.org>:
the 'goto cleanup' tests were introduced in 0fba2d90, way back in October 2003
Where can you see that "the 'goto cleanup' tests were introduced in 0fba2d90, way back in October 2003" ?
In the git repo I linked to in my previous e-mail.
- Matt
-- I have always wished that my computer would be as easy to use as my telephone. My wish has come true. I no longer know how to use my telephone. -- Bjarne Stroustrup
----- Original Message -----
From: "Matt Palmer" <mpalmer@hezmatt.org>
Fun times indeed. "Once is happenstance, twice is coincidence..."
And for the few who don't recall the last stanza -- and this is looking less and less by the month like it requires an aluminium foil fedora to buy as a justification: "Three times is enemy action." Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274
On Mar 4, 2014, at 9:07 PM, Jay Ashworth <jra@baylink.com> wrote:
Is this the *same* bug that just broke in Apple code last week?
No, the Apple bug was the existence of an /extra/ "goto fail;". The GnuTLS bug was that it was /missing/ a "goto fail;". I'm figuring the same developer worked on both, and just put the line in the wrong repository. :) And yes, while this is a joke, Apple fixed their bug by removing a "goto fail;", and GnuTLS fixed theirs by adding a "goto fail;". I can't make up something that funny. https://www.imperialviolet.org/2014/02/22/applebug.html http://blog.existentialize.com/the-story-of-the-gnutls-bug.html -- Leo Bicknell - bicknell@ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/
----- Original Message -----
From: "Leo Bicknell" <bicknell@ufp.org>
On Mar 4, 2014, at 9:07 PM, Jay Ashworth <jra@baylink.com> wrote:
Is this the *same* bug that just broke in Apple code last week?
No, the Apple bug was the existence of an /extra/ "goto fail;".
The GnuTLS bug was that it was /missing/ a "goto fail;".
I'm figuring the same developer worked on both, and just put the line in the wrong repository. :)
Those who speculate that these bugs happened at the behest of the NSA would probably agree with you. Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274
Doing some serious adjusting of my tinfoil today over his :) -jim On Wed, Mar 5, 2014 at 5:03 PM, Jay Ashworth <jra@baylink.com> wrote:
----- Original Message -----
From: "Leo Bicknell" <bicknell@ufp.org>
On Mar 4, 2014, at 9:07 PM, Jay Ashworth <jra@baylink.com> wrote:
Is this the *same* bug that just broke in Apple code last week?
No, the Apple bug was the existence of an /extra/ "goto fail;".
The GnuTLS bug was that it was /missing/ a "goto fail;".
I'm figuring the same developer worked on both, and just put the line in the wrong repository. :)
Those who speculate that these bugs happened at the behest of the NSA would probably agree with you.
Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274
Been spending most of the day scrubbing away that vuln in my facility here.... now here's the fun part: imagine just how many embedded devices (most of which get orphaned from a software maintenance perspective the moment they hit the store shelves) are gonna have this flaw. There's been the discussion of crappy home broadband CPE... Only a matter of time before someone fakes the certificate and breaks a "trusted" software update method, or heck... a dns explot + fake certificate = several million compromised payment card terminals. On Wed, Mar 5, 2014 at 4:58 PM, jim deleskie <deleskie@gmail.com> wrote:
Doing some serious adjusting of my tinfoil today over his :)
-jim
On Wed, Mar 5, 2014 at 5:03 PM, Jay Ashworth <jra@baylink.com> wrote:
----- Original Message -----
From: "Leo Bicknell" <bicknell@ufp.org>
On Mar 4, 2014, at 9:07 PM, Jay Ashworth <jra@baylink.com> wrote:
Is this the *same* bug that just broke in Apple code last week?
No, the Apple bug was the existence of an /extra/ "goto fail;".
The GnuTLS bug was that it was /missing/ a "goto fail;".
I'm figuring the same developer worked on both, and just put the line in the wrong repository. :)
Those who speculate that these bugs happened at the behest of the NSA would probably agree with you.
Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274
-- -- Tom Morris, KG4CYX Mad Scientist and Operations Manager, WDNA-FM 88.9 Miami - Serious Jazz! 786-228-7087 151.820 Megacycles
participants (6)
-
Jay Ashworth -
jim deleskie -
Leo Bicknell -
María García -
Matt Palmer -
Tom Morris