This feels like an old school vulnerability. Things like this were the norm in the 90's and early 2000's. It feels weird to see an exploit like this now in a large and well known project, and very weird for it to be in OpenBSD.

It just goes to show, as a user you can make informed choices in what software to use to reduce your security exposure, but that's not enough. You still need to pay attention to new problems that might pop up. No software is guaranteed to be safe in perpetuity.

In a world where we harden all of the things and write code in memory safe languages maybe memory corruption will be the old school vulnerability and this type of thing will be all that is left

Ever heard of retguard? This is not an exploiting bug, this is a parsing bug. It could happen with Rust too.

Which is exactly what he wrote.

Why is retguard relevant here?

Yep, there will always be parsing bugs like not sanitizing input, logic failures, weak algorithms, timing attacks, ...

That's why I like DBJs method. You still use a command line program, but you pass a filehandle that the authentication data can be read from.. this seems much safer than trying to parse and re-format that data as an intermediary. Also avoids any data leaks through the often unprotected 'cmdline'.

Is there some technical reason OpenBSD doesn't do this?

Thank God for DJB. His entire website should be required reading for software developers.

Thanks for the recommendation, I'd previously heard of DJB but was unaware of his writings.

Here's the link to his website: https://cr.yp.to/djb.html

I am convinced that DJB is actually the reincarnation of John von Neumann.

Seriously, how many other people make contributions in areas ranging all the way from number theory to hand-written machine code?

Probably historic compatibility. If making a breaking change this might be a good time to implement a design benefiting from decades of real world experiences.

That's literally what OpenBSD was doing over decades,

starting with binary compatibility

with Linux and a lot of legacy stuff

which came from NetBSD and BSD 4.4 lite/BSD 4.3.

You described OpenBSD with that comment.

- Xenocara with rootless privileges as a fork of X

- LibreSSL

- Linux compat going away

- Pledge/Unveil

- Some daemons belonging to ports

- HTTPD/SMTPD and so on as replacement of bloated daemons

- OpenSSH itself

- Retguard

This vulnerability is bad, but pledge

and unveil will have even

more prominent roles in base soon, so even

if you get privs, you can do either nil or just crash because of pledge.

Hu? Those vulnerabilities are authentication bypass and local privilege escalation; sandboxing like pledge is not going to help you at all there.

He was talking on innovation vs legacy cruft.

What does “DBJ” stand for?

Daniel Bernstein, author of qmail, djbdns, and daemontools among others.

And where does that auth-info-via-file-handle come from? I did a bit of duckduckgoing and couldn’t spot anything about that.

The qmail source code has this convention.

Thanks!

Some call the concept "Bernstein Chaining": http://www.catb.org/%7Eesr/writings/taoup/html/ch06s06.html

That's DJB. DBJs is a Javascript database thing. There is possible ambiguity here.

Fair point. I associate DJB with security and coding best practices, Javascript not so much. I can only hope the comment I replied to meant DJB the person.

I hope so too.

DJ Bernstein, famous for remixing sendmail and similar hits in the 90s

I think he means Daniel Bernstein, a prominent cryptographer and coder.

> They're shelling out to a command line program to do authentication

Interesting to track who exactly "they" might have been, as many commenters are saying this is uncharacteristic for OpenBSD.

Looking at the patch, the first OpenBSD commit of this file [1] is from 2000 and says "from BSDI" in the commit message, did fork()+execve() at that time, and the BSDI copyright comment says 1995-1997.

Probable to say more recent OpenBSD stuff is likely not written this way, but that they have baggage like this in the tree from earlier times.

[1] https://cvsweb.openbsd.org/src/lib/libc/gen/auth_subr.c?rev=...

Al of the 3 BSD's can be traced back to 386BSD and before, 4.4 BSD.

BSD Auth was designed by BSDi as an alternative to PAM. Only OpenBSD imported BSD Auth; NetBSD and FreeBSD went the PAM route.

There have been many bugs in NetBSD code that are found and fixed. Quite often these bugs are in code shared with OpenBSD, but you never see them list it as such, as they import said fixes from NetBSD.

edited: make verb plural.

Yeah. It's a shame how few people invoking shell commands use tricks like "--" to suppress option parsing and "./*" to suppress bad globs. :-(

The marriage operator is always a source of fun like this. So named as it's the end of options, and the beginning of arguments.

Brutal.

Yep, very cool.